Merge pull request #949 from jketema/dataflow-new

jketema · web-flow · commit e2932891c6a3 · 2025-08-22T10:10:29.000+02:00
Update more queries to the new dataflow library
diff --git a/c/cert/src/rules/STR31-C/StringsHasSufficientSpaceForTheNullTerminator.ql b/c/cert/src/rules/STR31-C/StringsHasSufficientSpaceForTheNullTerminator.ql
@@ -20,7 +20,7 @@
 
 import cpp
 import codingstandards.c.cert
-import semmle.code.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.new.TaintTracking
 import codingstandards.cpp.PossiblyUnsafeStringOperation
 
 /**
diff --git a/c/cert/test/rules/STR31-C/StringsHasSufficientSpaceForTheNullTerminator.expected b/c/cert/test/rules/STR31-C/StringsHasSufficientSpaceForTheNullTerminator.expected
@@ -1,9 +1,3 @@
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (StringsHasSufficientSpaceForTheNullTerminator.ql:62,31-39)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (StringsHasSufficientSpaceForTheNullTerminator.ql:62,55-63)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (StringsHasSufficientSpaceForTheNullTerminator.ql:68,31-39)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (StringsHasSufficientSpaceForTheNullTerminator.ql:68,54-62)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (StringsHasSufficientSpaceForTheNullTerminator.ql:62,5-18)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (StringsHasSufficientSpaceForTheNullTerminator.ql:68,5-18)
 | test.c:10:20:10:24 | Cod | Expression produces or consumes a string that may not have sufficient space for a null-terminator. |
 | test.c:16:3:16:9 | call to strncpy | Expression produces or consumes a string that may not have sufficient space for a null-terminator. |
 | test.c:26:3:26:10 | call to snprintf | Expression produces or consumes a string that may not have sufficient space for a null-terminator. |
diff --git a/c/common/test/rules/constlikereturnvalue/ConstLikeReturnValue.expected b/c/common/test/rules/constlikereturnvalue/ConstLikeReturnValue.expected
@@ -1,20 +1,29 @@
 problems
-| test.c:11:8:11:12 | c_str | test.c:18:16:18:21 | call to getenv | test.c:11:8:11:12 | c_str | The object returned by the function getenv should not be modified. |
+| test.c:11:7:11:12 | * ... | test.c:18:16:18:21 | call to getenv | test.c:11:7:11:12 | * ... | The object returned by the function getenv should not be modified. |
+| test.c:11:8:11:12 | c_str | test.c:18:16:18:21 | call to getenv | test.c:11:7:11:12 | * ... | The object returned by the function getenv should not be modified. |
 | test.c:67:5:67:9 | conv4 | test.c:64:11:64:20 | call to localeconv | test.c:67:5:67:9 | conv4 | The object returned by the function localeconv should not be modified. |
 | test.c:76:5:76:8 | conv | test.c:72:25:72:34 | call to localeconv | test.c:76:5:76:8 | conv | The object returned by the function localeconv should not be modified. |
 edges
-| test.c:8:18:8:22 | c_str | test.c:11:8:11:12 | c_str | provenance |  |
+| test.c:8:18:8:22 | c_str | test.c:11:7:11:12 | * ... | provenance |  |
+| test.c:18:16:18:21 | call to getenv | test.c:18:16:18:21 | call to getenv | provenance |  |
 | test.c:18:16:18:21 | call to getenv | test.c:24:9:24:12 | env1 | provenance |  |
 | test.c:24:9:24:12 | env1 | test.c:8:18:8:22 | c_str | provenance |  |
-| test.c:64:11:64:20 | call to localeconv | test.c:67:5:67:9 | conv4 | provenance |  |
-| test.c:72:25:72:34 | call to localeconv | test.c:76:5:76:8 | conv | provenance |  |
+| test.c:64:3:64:22 | ... = ... | test.c:67:5:67:9 | conv4 | provenance |  |
+| test.c:64:11:64:20 | call to localeconv | test.c:64:3:64:22 | ... = ... | provenance |  |
+| test.c:72:25:72:34 | call to localeconv | test.c:72:25:72:34 | call to localeconv | provenance |  |
+| test.c:72:25:72:34 | call to localeconv | test.c:73:24:73:28 | conv4 | provenance |  |
+| test.c:73:24:73:28 | conv4 | test.c:76:5:76:8 | conv | provenance |  |
 nodes
 | test.c:8:18:8:22 | c_str | semmle.label | c_str |
-| test.c:11:8:11:12 | c_str | semmle.label | c_str |
+| test.c:11:7:11:12 | * ... | semmle.label | * ... |
+| test.c:18:16:18:21 | call to getenv | semmle.label | call to getenv |
 | test.c:18:16:18:21 | call to getenv | semmle.label | call to getenv |
 | test.c:24:9:24:12 | env1 | semmle.label | env1 |
+| test.c:64:3:64:22 | ... = ... | semmle.label | ... = ... |
 | test.c:64:11:64:20 | call to localeconv | semmle.label | call to localeconv |
 | test.c:67:5:67:9 | conv4 | semmle.label | conv4 |
 | test.c:72:25:72:34 | call to localeconv | semmle.label | call to localeconv |
+| test.c:72:25:72:34 | call to localeconv | semmle.label | call to localeconv |
+| test.c:73:24:73:28 | conv4 | semmle.label | conv4 |
 | test.c:76:5:76:8 | conv | semmle.label | conv |
 subpaths
diff --git a/c/common/test/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.expected b/c/common/test/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.expected
@@ -10,27 +10,35 @@ problems
 | test.c:25:7:25:14 | ... >= ... | test.c:7:14:7:15 | l1 | test.c:25:7:25:8 | p1 | Compare operation >= comparing left operand pointing to array $@ and other operand pointing to array $@. | test.c:2:7:2:8 | l1 | l1 | test.c:4:7:4:8 | l3 | l3 |
 | test.c:25:7:25:14 | ... >= ... | test.c:25:13:25:14 | l3 | test.c:25:13:25:14 | l3 | Compare operation >= comparing right operand pointing to array $@ and other operand pointing to array $@. | test.c:4:7:4:8 | l3 | l3 | test.c:2:7:2:8 | l1 | l1 |
 edges
+| test.c:6:13:6:14 | l1 | test.c:6:13:6:14 | l1 | provenance |  |
 | test.c:6:13:6:14 | l1 | test.c:13:12:13:13 | p0 | provenance |  |
-| test.c:7:14:7:15 | l1 | test.c:7:14:7:18 | access to array | provenance | Config |
-| test.c:7:14:7:18 | access to array | test.c:11:7:11:8 | p1 | provenance |  |
-| test.c:7:14:7:18 | access to array | test.c:13:7:13:8 | p1 | provenance |  |
-| test.c:7:14:7:18 | access to array | test.c:15:13:15:14 | p1 | provenance |  |
-| test.c:7:14:7:18 | access to array | test.c:17:7:17:8 | p1 | provenance |  |
-| test.c:7:14:7:18 | access to array | test.c:23:13:23:14 | p1 | provenance |  |
-| test.c:7:14:7:18 | access to array | test.c:25:7:25:8 | p1 | provenance |  |
-| test.c:8:14:8:15 | l1 | test.c:8:14:8:18 | access to array | provenance | Config |
-| test.c:8:14:8:18 | access to array | test.c:11:12:11:13 | p2 | provenance |  |
-| test.c:8:14:8:18 | access to array | test.c:21:7:21:8 | p2 | provenance |  |
-| test.c:9:14:9:15 | l2 | test.c:9:14:9:18 | access to array | provenance | Config |
-| test.c:9:14:9:18 | access to array | test.c:21:12:21:13 | p3 | provenance |  |
+| test.c:7:13:7:18 | & ... | test.c:7:13:7:18 | & ... | provenance |  |
+| test.c:7:13:7:18 | & ... | test.c:11:7:11:8 | p1 | provenance |  |
+| test.c:7:13:7:18 | & ... | test.c:13:7:13:8 | p1 | provenance |  |
+| test.c:7:13:7:18 | & ... | test.c:15:13:15:14 | p1 | provenance |  |
+| test.c:7:13:7:18 | & ... | test.c:17:7:17:8 | p1 | provenance |  |
+| test.c:7:13:7:18 | & ... | test.c:23:13:23:14 | p1 | provenance |  |
+| test.c:7:13:7:18 | & ... | test.c:25:7:25:8 | p1 | provenance |  |
+| test.c:7:14:7:15 | l1 | test.c:7:13:7:18 | & ... | provenance | Config |
+| test.c:8:13:8:18 | & ... | test.c:8:13:8:18 | & ... | provenance |  |
+| test.c:8:13:8:18 | & ... | test.c:11:12:11:13 | p2 | provenance |  |
+| test.c:8:13:8:18 | & ... | test.c:21:7:21:8 | p2 | provenance |  |
+| test.c:8:14:8:15 | l1 | test.c:8:13:8:18 | & ... | provenance | Config |
+| test.c:9:13:9:18 | & ... | test.c:9:13:9:18 | & ... | provenance |  |
+| test.c:9:13:9:18 | & ... | test.c:21:12:21:13 | p3 | provenance |  |
+| test.c:9:14:9:15 | l2 | test.c:9:13:9:18 | & ... | provenance | Config |
 nodes
 | test.c:6:13:6:14 | l1 | semmle.label | l1 |
+| test.c:6:13:6:14 | l1 | semmle.label | l1 |
+| test.c:7:13:7:18 | & ... | semmle.label | & ... |
+| test.c:7:13:7:18 | & ... | semmle.label | & ... |
 | test.c:7:14:7:15 | l1 | semmle.label | l1 |
-| test.c:7:14:7:18 | access to array | semmle.label | access to array |
+| test.c:8:13:8:18 | & ... | semmle.label | & ... |
+| test.c:8:13:8:18 | & ... | semmle.label | & ... |
 | test.c:8:14:8:15 | l1 | semmle.label | l1 |
-| test.c:8:14:8:18 | access to array | semmle.label | access to array |
+| test.c:9:13:9:18 | & ... | semmle.label | & ... |
+| test.c:9:13:9:18 | & ... | semmle.label | & ... |
 | test.c:9:14:9:15 | l2 | semmle.label | l2 |
-| test.c:9:14:9:18 | access to array | semmle.label | access to array |
 | test.c:11:7:11:8 | p1 | semmle.label | p1 |
 | test.c:11:12:11:13 | p2 | semmle.label | p2 |
 | test.c:13:7:13:8 | p1 | semmle.label | p1 |
diff --git a/c/common/test/rules/onlyfreememoryallocateddynamicallyshared/OnlyFreeMemoryAllocatedDynamicallyShared.expected b/c/common/test/rules/onlyfreememoryallocateddynamicallyshared/OnlyFreeMemoryAllocatedDynamicallyShared.expected
@@ -7,8 +7,10 @@ problems
 | test.c:26:8:26:8 | p | test.c:25:13:25:14 | & ... | test.c:26:8:26:8 | p | Free expression frees memory which was not dynamically allocated. |
 edges
 | test.c:18:24:18:26 | ptr | test.c:18:36:18:38 | ptr | provenance |  |
+| test.c:25:13:25:14 | & ... | test.c:25:13:25:14 | & ... | provenance |  |
 | test.c:25:13:25:14 | & ... | test.c:26:8:26:8 | p | provenance |  |
-| test.c:27:7:27:8 | & ... | test.c:28:15:28:15 | p | provenance |  |
+| test.c:27:3:27:8 | ... = ... | test.c:28:15:28:15 | p | provenance |  |
+| test.c:27:7:27:8 | & ... | test.c:27:3:27:8 | ... = ... | provenance |  |
 | test.c:28:15:28:15 | p | test.c:18:24:18:26 | ptr | provenance |  |
 nodes
 | test.c:8:8:8:10 | g_p | semmle.label | g_p |
@@ -18,7 +20,9 @@ nodes
 | test.c:18:24:18:26 | ptr | semmle.label | ptr |
 | test.c:18:36:18:38 | ptr | semmle.label | ptr |
 | test.c:25:13:25:14 | & ... | semmle.label | & ... |
+| test.c:25:13:25:14 | & ... | semmle.label | & ... |
 | test.c:26:8:26:8 | p | semmle.label | p |
+| test.c:27:3:27:8 | ... = ... | semmle.label | ... = ... |
 | test.c:27:7:27:8 | & ... | semmle.label | & ... |
 | test.c:28:15:28:15 | p | semmle.label | p |
 subpaths
diff --git a/cpp/autosar/src/rules/A8-4-11/SmartPointerAsParameterWithoutLifetimeSemantics.ql b/cpp/autosar/src/rules/A8-4-11/SmartPointerAsParameterWithoutLifetimeSemantics.ql
@@ -16,7 +16,7 @@
 import cpp
 import codingstandards.cpp.autosar
 import codingstandards.cpp.SmartPointers
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 import codingstandards.cpp.standardlibrary.Utility
 
 Expr lifetimeAffectingSmartPointerExpr(Function f) {
diff --git a/cpp/autosar/src/rules/A8-4-9/InOutParametersDeclaredAsTNotModified.ql b/cpp/autosar/src/rules/A8-4-9/InOutParametersDeclaredAsTNotModified.ql
@@ -21,7 +21,7 @@ import codingstandards.cpp.autosar
 import codingstandards.cpp.FunctionParameter
 import codingstandards.cpp.ConstHelpers
 import codingstandards.cpp.Operator
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 
 /**
  * Non-const T& `Parameter`s to `Function`s
diff --git a/cpp/autosar/src/rules/M9-3-1/ConstMemberFunctionReturnsNonConstPointer.ql b/cpp/autosar/src/rules/M9-3-1/ConstMemberFunctionReturnsNonConstPointer.ql
@@ -18,7 +18,7 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 
 class ReferenceTypeWithNonConstBaseType extends ReferenceType {
   ReferenceTypeWithNonConstBaseType() { not this.getBaseType().isConst() }
@@ -46,14 +46,16 @@ class ConstMemberFunctionWithRetNonConst extends ConstMemberFunction {
 from ConstMemberFunctionWithRetNonConst fun, Locatable f
 where
   not isExcluded(fun, ConstPackage::constMemberFunctionReturnsNonConstPointerQuery()) and
-  exists(ReturnStmt ret |
+  exists(ReturnStmt ret, DataFlow::Node vaNode, DataFlow::Node retNode |
     ret.getEnclosingFunction() = fun and
+    retNode.asIndirectExpr() = ret.getExpr() and
     (
-      f.(MemberVariable).getDeclaringType() = fun.getDeclaringType() and
-      DataFlow::localExprFlow(f.(MemberVariable).getAnAccess(), ret.getExpr())
+      vaNode.asIndirectExpr() = f.(MemberVariable).getAnAccess() and
+      f.(MemberVariable).getDeclaringType() = fun.getDeclaringType()
       or
-      DataFlow::localExprFlow(f.(ThisExpr), ret.getExpr())
-    )
+      vaNode.asIndirectExpr() = f.(ThisExpr)
+    ) and
+    DataFlow::localFlow(vaNode, retNode)
   )
 select fun, "Const member function returns a " + fun.getReturnTypeCategory() + " to class data $@.",
   f, f.toString()
diff --git a/cpp/autosar/test/rules/A8-4-11/SmartPointerAsParameterWithoutLifetimeSemantics.expected b/cpp/autosar/test/rules/A8-4-11/SmartPointerAsParameterWithoutLifetimeSemantics.expected
@@ -1,5 +1,3 @@
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (SmartPointerAsParameterWithoutLifetimeSemantics.ql:47,3-11)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (SmartPointerAsParameterWithoutLifetimeSemantics.ql:56,5-13)
 | test.cpp:7:41:7:43 | up1 | Function $@ takes smart pointer parameter 'up1' but does not implement any lifetime-affecting operations. | test.cpp:7:6:7:18 | smart_ptr_get | smart_ptr_get |
 | test.cpp:16:53:16:55 | sp1 | Function $@ takes smart pointer parameter 'sp1' but does not implement any lifetime-affecting operations. | test.cpp:16:6:16:29 | smart_ptr_ref_assign_ref | smart_ptr_ref_assign_ref |
 | test.cpp:28:55:28:57 | sp1 | Function $@ takes smart pointer parameter 'sp1' but does not implement any lifetime-affecting operations. | test.cpp:28:6:28:31 | smart_ptr_ref_noncompliant | smart_ptr_ref_noncompliant |
diff --git a/cpp/autosar/test/rules/A8-4-9/InOutParametersDeclaredAsTNotModified.expected b/cpp/autosar/test/rules/A8-4-9/InOutParametersDeclaredAsTNotModified.expected
@@ -1,5 +1,3 @@
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (InOutParametersDeclaredAsTNotModified.ql:50,7-15)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (InOutParametersDeclaredAsTNotModified.ql:64,7-15)
 | test.cpp:4:13:4:13 | i | In-out parameter i that is not written to. |
 | test.cpp:7:22:7:24 | str | In-out parameter str that is not read from. |
 | test.cpp:18:14:18:14 | i | In-out parameter i that is not read from. |
diff --git a/cpp/autosar/test/rules/M9-3-1/ConstMemberFunctionReturnsNonConstPointer.expected b/cpp/autosar/test/rules/M9-3-1/ConstMemberFunctionReturnsNonConstPointer.expected
@@ -1,5 +1,3 @@
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (ConstMemberFunctionReturnsNonConstPointer.ql:53,7-15)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (ConstMemberFunctionReturnsNonConstPointer.ql:55,7-15)
 | test.cpp:8:8:8:11 | getA | Const member function returns a pointer to class data $@. | test.cpp:3:8:3:8 | a | a |
 | test.cpp:9:8:9:11 | getB | Const member function returns a pointer to class data $@. | test.cpp:4:8:4:8 | b | b |
 | test.cpp:11:6:11:12 | getThis | Const member function returns a pointer to class data $@. | test.cpp:11:36:11:39 | this | this |
diff --git a/cpp/common/src/codingstandards/cpp/rules/basicstringmaynotbenullterminated/BasicStringMayNotBeNullTerminated.qll b/cpp/common/src/codingstandards/cpp/rules/basicstringmaynotbenullterminated/BasicStringMayNotBeNullTerminated.qll
@@ -8,8 +8,7 @@ import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import semmle.code.cpp.security.BufferWrite
 import semmle.code.cpp.commons.Buffer
-import semmle.code.cpp.dataflow.DataFlow
-import semmle.code.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.new.TaintTracking
 import codingstandards.cpp.PossiblyUnsafeStringOperation
 
 abstract class BasicStringMayNotBeNullTerminatedSharedQuery extends Query { }
@@ -40,8 +39,13 @@ query predicate problems(BasicStringConstructorCall cc, string message) {
     // a) is not a string literal
     not arg instanceof StringLiteral and
     // b) may exist in a dataflow from an unsafe usage of a string function
-    exists(PossiblyUnsafeStringOperation op |
-      TaintTracking::localTaint(DataFlow::exprNode(op.getAnArgument()), DataFlow::exprNode(arg))
+    exists(
+      PossiblyUnsafeStringOperation op, DataFlow::DefinitionByReferenceNode opNode,
+      DataFlow::Node argNode
+    |
+      opNode.asDefiningArgument() = op.getAnArgument() and argNode.asIndirectExpr() = arg
+    |
+      TaintTracking::localTaint(opNode, argNode)
     ) and
     message = "Construction of string object with possibly non-null terminated C-style string."
   )
diff --git a/cpp/common/src/codingstandards/cpp/rules/constlikereturnvalue/ConstLikeReturnValue.qll b/cpp/common/src/codingstandards/cpp/rules/constlikereturnvalue/ConstLikeReturnValue.qll
@@ -8,7 +8,7 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 import DFFlow::PathGraph
 
 abstract class ConstLikeReturnValueSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/danglingcapturewhenmovinglambdaobject/DanglingCaptureWhenMovingLambdaObject.qll b/cpp/common/src/codingstandards/cpp/rules/danglingcapturewhenmovinglambdaobject/DanglingCaptureWhenMovingLambdaObject.qll
@@ -5,7 +5,7 @@
  */
 
 import cpp
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.Expr
diff --git a/cpp/common/src/codingstandards/cpp/rules/danglingcapturewhenreturninglambdaobject/DanglingCaptureWhenReturningLambdaObject.qll b/cpp/common/src/codingstandards/cpp/rules/danglingcapturewhenreturninglambdaobject/DanglingCaptureWhenReturningLambdaObject.qll
@@ -5,7 +5,7 @@
  */
 
 import cpp
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 
@@ -48,7 +48,14 @@ query predicate problems(
   not isExcluded(returnStmt, getQuery()) and
   lambda.getACapture() = danglingCapture and
   (
-    DataFlow::localExprFlow(lambda, returnStmt.getExpr())
+    returnStmt.getExpr() = lambda
+    or
+    exists(DataFlow::Node lambdaNode, DataFlow::Node returnNode |
+      lambdaNode.asExpr() = lambda and
+      returnNode.asIndirectExpr() = returnStmt.getExpr()
+    |
+      DataFlow::localFlow(lambdaNode, returnNode)
+    )
     or
     // implement a rough heuristic to catch the results of constructors (such as std::function's)
     // which take an argument that has a dangling capture and flow to a return statement
diff --git a/cpp/common/src/codingstandards/cpp/rules/donotaccessaclosedfile/DoNotAccessAClosedFile.qll b/cpp/common/src/codingstandards/cpp/rules/donotaccessaclosedfile/DoNotAccessAClosedFile.qll
@@ -6,7 +6,7 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 import codingstandards.cpp.standardlibrary.FileAccess
 import semmle.code.cpp.controlflow.SubBasicBlocks
 
@@ -40,9 +40,10 @@ SubBasicBlock followsFileClose(SubBasicBlock source, Expr closedFile) {
 
 // the argument of a call to function `fclose(FILE*)` is subsequently accessed
 predicate closedFileAccess(Expr closedFile, Expr fileAccess) {
-  exists(DataFlow::DefinitionByReferenceNode def |
+  exists(DataFlow::DefinitionByReferenceNode def, DataFlow::Node va |
+    va.asIndirectExpr() = fileAccess.(VariableAccess) and
     def.asDefiningArgument() = closedFile and
-    DataFlow::localFlow(def, DataFlow::exprNode(fileAccess.(VariableAccess)))
+    DataFlow::localFlow(def, va)
   )
 }
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/donotpassaliasedpointertorestrictqualifiedparamshared/DoNotPassAliasedPointerToRestrictQualifiedParamShared.qll b/cpp/common/src/codingstandards/cpp/rules/donotpassaliasedpointertorestrictqualifiedparamshared/DoNotPassAliasedPointerToRestrictQualifiedParamShared.qll
@@ -7,7 +7,7 @@ import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.types.Pointers
 import codingstandards.cpp.Variable
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 import semmle.code.cpp.pointsto.PointsTo
 import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.qll b/cpp/common/src/codingstandards/cpp/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.qll
@@ -7,7 +7,7 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 import ArrayToRelationalOperationOperandFlow::PathGraph
 
 abstract class DoNotUseRelationalOperatorsWithDifferingArraysSharedQuery extends Query { }
@@ -43,6 +43,8 @@ module ArrayToRelationalOperationOperandConfig implements DataFlow::ConfigSig {
     // Add a flow step from the base to the array expression to track pointers to elements of the array.
     exists(ArrayExpr e | e.getArrayBase() = pred.asExpr() and e = succ.asExpr())
   }
+
+  predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
 }
 
 module ArrayToRelationalOperationOperandFlow =
diff --git a/cpp/common/src/codingstandards/cpp/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.qll b/cpp/common/src/codingstandards/cpp/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.qll
@@ -4,7 +4,7 @@
 
 import cpp
 import codingstandards.cpp.Customizations
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 import semmle.code.cpp.controlflow.Guards
 import codingstandards.cpp.Exclusions
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/invalidatedenvstringpointers/InvalidatedEnvStringPointers.qll b/cpp/common/src/codingstandards/cpp/rules/invalidatedenvstringpointers/InvalidatedEnvStringPointers.qll
@@ -6,7 +6,7 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 
 abstract class InvalidatedEnvStringPointersSharedQuery extends Query { }
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/movedfromobjectsunspecifiedstate/MovedFromObjectsUnspecifiedState.qll b/cpp/common/src/codingstandards/cpp/rules/movedfromobjectsunspecifiedstate/MovedFromObjectsUnspecifiedState.qll
@@ -4,7 +4,7 @@
  */
 
 import cpp
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.standardlibrary.Utility
 
@@ -75,9 +75,10 @@ query predicate problems(Expr e, string message, StdMoveCall f, string argDesc)
   not e instanceof ReassignedExpression and
   // object moved to safe functions are preserved
   not exists(SafeRead safe | f = safe.getArgument(0)) and
-  exists(DataFlow::DefinitionByReferenceNode def |
-    def.asDefiningArgument() = f and
-    DataFlow::localFlow(def, DataFlow::exprNode(e))
+  exists(DataFlow::DefinitionByReferenceNode def, DataFlow::Node n |
+    f.getArgument(0) = def.getArgument() and
+    n.asIndirectExpr() = e and
+    DataFlow::localFlow(def, n)
   ) and
   message = "The argument of the $@ may be indeterminate when accessed at this location." and
   argDesc = f.toString()
diff --git a/cpp/common/src/codingstandards/cpp/rules/onlyfreememoryallocateddynamicallyshared/OnlyFreeMemoryAllocatedDynamicallyShared.qll b/cpp/common/src/codingstandards/cpp/rules/onlyfreememoryallocateddynamicallyshared/OnlyFreeMemoryAllocatedDynamicallyShared.qll
@@ -7,7 +7,7 @@ import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.Allocations
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 import NonDynamicPointerToFreeFlow::PathGraph
 
 /**
diff --git a/cpp/common/src/codingstandards/cpp/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.qll b/cpp/common/src/codingstandards/cpp/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.qll
@@ -8,7 +8,7 @@ import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.SmartPointers
-import semmle.code.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.new.TaintTracking
 import PointerToSmartPointerConstructorFlowFlow::PathGraph
 
 abstract class OwnedPointerValueStoredInUnrelatedSmartPointerSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/placementnewinsufficientstorage/PlacementNewInsufficientStorage.qll b/cpp/common/src/codingstandards/cpp/rules/placementnewinsufficientstorage/PlacementNewInsufficientStorage.qll
@@ -7,7 +7,6 @@ import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.allocations.PlacementNew
-import semmle.code.cpp.dataflow.DataFlow
 import PlacementNewOriginFlow::PathGraph
 
 abstract class PlacementNewInsufficientStorageSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/placementnewnotproperlyaligned/PlacementNewNotProperlyAligned.qll b/cpp/common/src/codingstandards/cpp/rules/placementnewnotproperlyaligned/PlacementNewNotProperlyAligned.qll
diff --git a/cpp/common/src/codingstandards/cpp/rules/predicatefunctionobjectsshouldnotbemutable/PredicateFunctionObjectsShouldNotBeMutable.qll b/cpp/common/src/codingstandards/cpp/rules/predicatefunctionobjectsshouldnotbemutable/PredicateFunctionObjectsShouldNotBeMutable.qll
diff --git a/cpp/common/src/codingstandards/cpp/rules/throwingoperatornewreturnsnull/ThrowingOperatorNewReturnsNull.qll b/cpp/common/src/codingstandards/cpp/rules/throwingoperatornewreturnsnull/ThrowingOperatorNewReturnsNull.qll
diff --git a/cpp/common/src/codingstandards/cpp/standardlibrary/FileStreams.qll b/cpp/common/src/codingstandards/cpp/standardlibrary/FileStreams.qll
diff --git a/cpp/common/test/rules/constlikereturnvalue/ConstLikeReturnValue.expected b/cpp/common/test/rules/constlikereturnvalue/ConstLikeReturnValue.expected
diff --git a/cpp/common/test/rules/danglingcapturewhenreturninglambdaobject/DanglingCaptureWhenReturningLambdaObject.expected b/cpp/common/test/rules/danglingcapturewhenreturninglambdaobject/DanglingCaptureWhenReturningLambdaObject.expected
diff --git a/cpp/common/test/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.expected b/cpp/common/test/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.expected
diff --git a/cpp/common/test/rules/movedfromobjectsunspecifiedstate/MovedFromObjectsUnspecifiedState.expected b/cpp/common/test/rules/movedfromobjectsunspecifiedstate/MovedFromObjectsUnspecifiedState.expected
diff --git a/cpp/common/test/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.expected b/cpp/common/test/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.expected
diff --git a/cpp/common/test/rules/throwingoperatornewreturnsnull/ThrowingOperatorNewReturnsNull.expected b/cpp/common/test/rules/throwingoperatornewreturnsnull/ThrowingOperatorNewReturnsNull.expected

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,3 @@`
`1`		`-WARNING: module 'DataFlow' has been deprecated and may be removed in future (InOutParametersDeclaredAsTNotModified.ql:50,7-15)`
`2`		`-WARNING: module 'DataFlow' has been deprecated and may be removed in future (InOutParametersDeclaredAsTNotModified.ql:64,7-15)`
`3`	`1`	`\| test.cpp:4:13:4:13 \| i \| In-out parameter i that is not written to. \|`
`4`	`2`	`\| test.cpp:7:22:7:24 \| str \| In-out parameter str that is not read from. \|`
`5`	`3`	`\| test.cpp:18:14:18:14 \| i \| In-out parameter i that is not read from. \|`