github · hvitved · Jul 9, 2026 · Jul 8, 2026 · Jul 9, 2026 · Jul 9, 2026
@@ -17,9 +17,11 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
 
   class SummarizedCallableBase = Function;
 
-  class SourceBase = Void;
+  class SourceBase extends Void {
+    Location getLocation() { none() }
+  }
 
-  class SinkBase = Void;
+  class SinkBase = SourceBase;
 
   class FlowSummaryCallBase = CallInstruction;
 
@@ -132,10 +134,22 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
 
 private import Make<Location, DataFlowImplSpecific::CppDataFlow, Input> as Impl
 
-private module StepsInput implements Impl::Private::StepsInputSig {
-  Impl::Private::SummaryNode getSummaryNode(Node n) {
-    result = n.(FlowSummaryNode).getSummaryNode()
+private module Input2 implements Impl::Private::InputSig2 {
+  private import codeql.util.Void
+
+  class SourceSinkReportingElement extends Void {
+    Location getLocation() { none() }
+
+    DataFlowCallable getEnclosingCallable() { none() }
+
+    SourceSinkReportingElement getASuccessor(Impl::Private::SummaryComponent sc) { none() }
   }
+}
+
+private import Impl::Private::Make2<Input2> as Impl2
+
+private module StepsInput implements Impl2::StepsInputSig {
+  Impl2::SummaryNode getSummaryNode(Node n) { result = n.(FlowSummaryNode).getSummaryNode() }
 
   DataFlowCall getACall(Public::SummarizedCallable sc) {
     result.getStaticCallTarget().getUnderlyingCallable() = sc
@@ -148,12 +162,6 @@ private module StepsInput implements Impl::Private::StepsInputSig {
         pragma[only_bind_out](out.getIndirectionIndex())
     )
   }
-
-  DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) { none() }
-
-  Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { none() }
-
-  Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
 }
 
 module SourceSinkInterpretationInput implements
@@ -270,8 +278,9 @@ module SourceSinkInterpretationInput implements
 
 module Private {
   import Impl::Private
+  import Impl2
 
-  module Steps = Impl::Private::Steps<StepsInput>;
+  module Steps = Impl2::Steps<StepsInput>;
 
   module External {
     import Impl::Private::External

@@ -1535,10 +1535,10 @@ class FlowSummaryNode extends Node, TFlowSummaryNode {
   }
 
   override DataFlowCallable getEnclosingCallable() {
-    result = FlowSummaryImpl::Private::getEnclosingCallable(this.getSummaryNode())
+    result = this.getSummaryNode().getEnclosingCallable()
   }
 
-  override Location getLocationImpl() { result = this.getSummarizedCallable().getLocation() }
+  override Location getLocationImpl() { result = this.getSummaryNode().getLocation() }
 
   override string toStringImpl() { result = this.getSummaryNode().toString() }
 }

@@ -119,8 +119,7 @@ private module Cached {
     )
     or
     // models-as-data summarized flow
-    FlowSummaryImpl::Private::Steps::summaryJumpStep(n1.(FlowSummaryNode).getSummaryNode(),
-      n2.(FlowSummaryNode).getSummaryNode())
+    FlowSummaryImpl::Private::Steps::summaryJumpStep(n1, n2)
   }
 
   /**

@@ -158,8 +158,7 @@ private module Cached {
     model = ""
     or
     // models-as-data summarized flow
-    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom,
-      nodeTo.(FlowSummaryNode).getSummaryNode(), true, model)
+    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, true, model)
   }
 
   private predicate simpleInstructionLocalFlowStep(Operand opFrom, Instruction iTo) {

@@ -67,8 +67,7 @@ private module Cached {
     model = ""
     or
     // models-as-data summarized flow
-    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom,
-      nodeTo.(FlowSummaryNode).getSummaryNode(), false, model)
+    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, false, model)
     or
     // object->field conflation for content that is a `TaintInheritingContent`.
     exists(DataFlow::ContentSet f |

@@ -714,8 +714,7 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo, string model) {
   ) and
   model = ""
   or
-  FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom,
-    nodeTo.(FlowSummaryNode).getSummaryNode(), true, model)
+  FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, true, model)
 }
 
 /**
@@ -1778,7 +1777,7 @@ class FlowSummaryNode extends NodeImpl, TFlowSummaryNode {
   }
 
   override DataFlowCallable getEnclosingCallableImpl() {
-    result.asSummarizedCallable() = this.getSummarizedCallable()
+    result = this.getSummaryNode().getEnclosingCallable()
   }
 
   override DataFlowType getDataFlowType() {
@@ -1789,7 +1788,7 @@ class FlowSummaryNode extends NodeImpl, TFlowSummaryNode {
 
   override ControlFlowNode getControlFlowNodeImpl() { none() }
 
-  override Location getLocationImpl() { result = this.getSummarizedCallable().getLocation() }
+  override Location getLocationImpl() { result = this.getSummaryNode().getLocation() }
 
   override string toStringImpl() { result = this.getSummaryNode().toString() }
 }
@@ -2085,8 +2084,7 @@ predicate jumpStep(Node pred, Node succ) {
     )
   )
   or
-  FlowSummaryImpl::Private::Steps::summaryJumpStep(pred.(FlowSummaryNode).getSummaryNode(),
-    succ.(FlowSummaryNode).getSummaryNode())
+  FlowSummaryImpl::Private::Steps::summaryJumpStep(pred, succ)
   or
   succ = pred.(LocalFunctionCreationNode).getAnAccess(false)
 }

@@ -30,11 +30,17 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CsharpDataFlow>
     )
   }
 
-  class SourceBase = Void;
+  class SourceBase extends Void {
+    Location getLocation() { none() }
+  }
+
+  class SinkBase = SourceBase;
 
-  class SinkBase = Void;
+  class FlowSummaryCallBase = SourceBase;
 
-  class FlowSummaryCallBase = Void;
+  DataFlowCallable getSummarizedCallableAsDataFlowCallable(SummarizedCallableBase c) {
+    result.asSummarizedCallable() = c
+  }
 
   predicate neutralElement(SummarizedCallableBase c, string kind, string provenance, boolean isExact) {
     interpretNeutral(c, kind, provenance, isExact)
@@ -122,7 +128,21 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CsharpDataFlow>
 
 private import Make<Location, DataFlowImplSpecific::CsharpDataFlow, Input> as Impl
 
-private module TypesInput implements Impl::Private::TypesInputSig {
+private module Input2 implements Impl::Private::InputSig2 {
+  private import codeql.util.Void
+
+  class SourceSinkReportingElement extends Void {
+    Location getLocation() { none() }
+
+    DataFlowCallable getEnclosingCallable() { none() }
+
+    SourceSinkReportingElement getASuccessor(Impl::Private::SummaryComponent sc) { none() }
+  }
+}
+
+private import Impl::Private::Make2<Input2> as Impl2
+
+private module TypesInput implements Impl2::TypesInputSig {
   DataFlowType getSyntheticGlobalType(Impl::Private::SyntheticGlobal sg) {
     exists(sg) and
     result.asGvnType() = Gvn::getGlobalValueNumber(any(ObjectType t))
@@ -195,27 +215,15 @@ private module TypesInput implements Impl::Private::TypesInputSig {
     )
   }
 
-  DataFlowType getSourceType(Input::SourceBase source, Impl::Private::SummaryComponentStack s) {
-    none()
-  }
-
-  DataFlowType getSinkType(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
+  DataFlowType getSourceSinkType(Input2::SourceSinkReportingElement e) { none() }
 }
 
-private module StepsInput implements Impl::Private::StepsInputSig {
-  Impl::Private::SummaryNode getSummaryNode(Node n) {
-    result = n.(FlowSummaryNode).getSummaryNode()
-  }
+private module StepsInput implements Impl2::StepsInputSig {
+  Impl2::SummaryNode getSummaryNode(Node n) { result = n.(FlowSummaryNode).getSummaryNode() }
 
   DataFlowCall getACall(Public::SummarizedCallable sc) {
     sc = viableCallable(result).asSummarizedCallable()
   }
-
-  DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) { none() }
-
-  Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { none() }
-
-  Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
 }
 
 module SourceSinkInterpretationInput implements
@@ -339,9 +347,10 @@ module SourceSinkInterpretationInput implements
 
 module Private {
   import Impl::Private
-  import Impl::Private::Types<TypesInput>
+  import Impl2
+  import Types<TypesInput>
 
-  module Steps = Impl::Private::Steps<StepsInput>;
+  module Steps = Impl2::Steps<StepsInput>;
 
   module External {
     import Impl::Private::External

@@ -171,8 +171,7 @@ private module Cached {
     ) and
     model = ""
     or
-    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom,
-      nodeTo.(FlowSummaryNode).getSummaryNode(), false, model)
+    FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, false, model)
   }
 }
 

@@ -82,7 +82,7 @@ module Private {
       result = this.getSummaryNode().getSummarizedCallable()
     }
 
-    override Location getLocation() { result = this.getSummarizedCallable().getLocation() }
+    override Location getLocation() { result = this.getSummaryNode().getLocation() }
 
     override string toString() { result = this.getSummaryNode().toString() }
 

@@ -153,8 +153,7 @@ predicate jumpStep(Node n1, Node n2) {
     n2 = recvRead
   )
   or
-  FlowSummaryImpl::Private::Steps::summaryJumpStep(n1.(FlowSummaryNode).getSummaryNode(),
-    n2.(FlowSummaryNode).getSummaryNode())
+  FlowSummaryImpl::Private::Steps::summaryJumpStep(n1, n2)
 }
 
 /**

@@ -141,8 +141,7 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo, string model) {
   any(FunctionModel m).flowStep(nodeFrom, nodeTo) and
   model = "FunctionModel"
   or
-  FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom,
-    nodeTo.(FlowSummaryNode).getSummaryNode(), true, model)
+  FlowSummaryImpl::Private::Steps::summaryLocalStep(nodeFrom, nodeTo, true, model)
 }
 
 /**

@@ -27,14 +27,20 @@ module Input implements InputSig<Location, DataFlowImplSpecific::GoDataFlow> {
 
   class SummarizedCallableBase = Callable;
 
-  class SourceBase = Void;
+  class SourceBase extends Void {
+    Location getLocation() { none() }
+  }
 
-  class SinkBase = Void;
+  class SinkBase = SourceBase;
 
-  class FlowSummaryCallBase = Void;
+  class FlowSummaryCallBase = SourceBase;
 
   predicate callableFromSource(SummarizedCallableBase c) { exists(c.getFuncDef()) }
 
+  DataFlowCallable getSummarizedCallableAsDataFlowCallable(SummarizedCallableBase c) {
+    result.asSummarizedCallable() = c
+  }
+
   predicate neutralElement(
     Input::SummarizedCallableBase c, string kind, string provenance, boolean isExact
   ) {
@@ -114,23 +120,29 @@ module Input implements InputSig<Location, DataFlowImplSpecific::GoDataFlow> {
 
 private import Make<Location, DataFlowImplSpecific::GoDataFlow, Input> as Impl
 
-private module StepsInput implements Impl::Private::StepsInputSig {
-  Impl::Private::SummaryNode getSummaryNode(Node n) {
-    result = n.(FlowSummaryNode).getSummaryNode()
+private module Input2 implements Impl::Private::InputSig2 {
+  private import codeql.util.Void
+
+  class SourceSinkReportingElement extends Void {
+    Location getLocation() { none() }
+
+    DataFlowCallable getEnclosingCallable() { none() }
+
+    SourceSinkReportingElement getASuccessor(Impl::Private::SummaryComponent sc) { none() }
   }
+}
+
+private import Impl::Private::Make2<Input2> as Impl2
+
+private module StepsInput implements Impl2::StepsInputSig {
+  Impl2::SummaryNode getSummaryNode(Node n) { result = n.(FlowSummaryNode).getSummaryNode() }
 
   DataFlowCall getACall(Public::SummarizedCallable sc) {
     exists(DataFlow::CallNode call |
       call.asExpr() = result and
       call.getACalleeIncludingExternals() = sc
     )
   }
-
-  DataFlowCallable getSourceNodeEnclosingCallable(Input::SourceBase source) { none() }
-
-  Node getSourceNode(Input::SourceBase source, Impl::Private::SummaryComponentStack s) { none() }
-
-  Node getSinkNode(Input::SinkBase sink, Impl::Private::SummaryComponent sc) { none() }
 }
 
 module SourceSinkInterpretationInput implements
@@ -500,8 +512,9 @@ private predicate parseReturn(AccessPath::AccessPathTokenBase c, int n) {
 
 module Private {
   import Impl::Private
+  import Impl2
 
-  module Steps = Impl::Private::Steps<StepsInput>;
+  module Steps = Impl2::Steps<StepsInput>;
 
   module External {
     import Impl::Private::External

@@ -109,8 +109,7 @@ private predicate localAdditionalForwardTaintStep(
   or
   any(AdditionalTaintStep a).step(pred, succ) and model = "AdditionalTaintStep"
   or
-  FlowSummaryImpl::Private::Steps::summaryLocalStep(pred,
-    succ.(DataFlowPrivate::FlowSummaryNode).getSummaryNode(), false, model)
+  FlowSummaryImpl::Private::Steps::summaryLocalStep(pred, succ, false, model)
 }
 
 /**

@@ -439,7 +439,7 @@ module Private {
     result.asCallable() = n.(ImplicitInstanceAccess).getInstanceAccess().getEnclosingCallable() or
     result.asCallable() = n.(MallocNode).getClassInstanceExpr().getEnclosingCallable() or
     result = nodeGetEnclosingCallable(n.(ImplicitPostUpdateNode).getPreUpdateNode()) or
-    result.asSummarizedCallable() = n.(FlowSummaryNode).getSummarizedCallable() or
+    result = n.(FlowSummaryNode).getSummaryNode().getEnclosingCallable() or
     result.asCallable() = n.(CaptureNode).getSynthesizedCaptureNode().getEnclosingCallable() or
     result.asFieldScope() = n.(FieldValueNode).getField() or
     result.asCallable() = any(Expr e | n.(AdditionalNode).nodeAt(e, _)).getEnclosingCallable() or
@@ -531,7 +531,7 @@ module Private {
       result = this.getSummaryNode().getSummarizedCallable()
     }
 
-    override Location getLocation() { result = this.getSummarizedCallable().getLocation() }
+    override Location getLocation() { result = this.getSummaryNode().getLocation() }
 
     override string toString() { result = this.getSummaryNode().toString() }
 

@@ -199,8 +199,7 @@ predicate jumpStep(Node node1, Node node2) {
   any(AdditionalValueStep a).step(node1, node2) and
   node1.getEnclosingCallable() != node2.getEnclosingCallable()
   or
-  FlowSummaryImpl::Private::Steps::summaryJumpStep(node1.(FlowSummaryNode).getSummaryNode(),
-    node2.(FlowSummaryNode).getSummaryNode())
+  FlowSummaryImpl::Private::Steps::summaryJumpStep(node1, node2)
 }
 
 /**

@@ -247,8 +247,7 @@ private predicate simpleLocalFlowStep0(Node node1, Node node2, string model) {
   or
   cloneStep(node1, node2) and model = "CloneStep"
   or
-  FlowSummaryImpl::Private::Steps::summaryLocalStep(node1, node2.(FlowSummaryNode).getSummaryNode(),
-    true, model)
+  FlowSummaryImpl::Private::Steps::summaryLocalStep(node1, node2, true, model)
 }
 
 /**