🟡 Changes recommended

Several summaries lose flow through modifiable return references and assignment results.

Get a fresh assessment by requesting another Copilot review.

Adds contained-value flow modeling for BDE nullable and variant wrappers.

Changes:

• Adds type-aware assignment and emplacement summaries.
• Models accessors, copying, moving, and reference writes.
• Adds data-flow tests and release documentation.

Suppressed comments (4)

cpp/ql/lib/semmle/code/cpp/models/implementations/BdlbValues.qll:85

• Both emplacement APIs return a modifiable reference to the newly stored value, but this summary has no return-to-wrapper edge. Consequently, writes such as n.makeValueInplace(0) = source() or v.createInPlace<int>(0) = source() are lost when the wrapper is read later. Add the same reverse paths used for value()/the().

      output = ["Argument[-1].Element[" + stars + "]", "ReturnValue[*" + stars + "]"]

cpp/ql/lib/ext/bdlb.values.model.yml:14

• The move-assignment summary does not propagate the moved contents to the returned NullableValue&, so chained reads from (dst = move(src)) miss flow. Add a parallel ReturnValue[*].Element[@] output for this signature.

      - ["BloombergLP::bdlb", "NullableValue", False, "operator=", "(NullableValue &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]

cpp/ql/lib/ext/bdlb.values.model.yml:19

• The copy-assignment model omits flow to the returned VariantImp&. As a result, reading the contained value through (dst = src) loses the copied taint even though the returned reference aliases dst. Add the corresponding return-value element summary.

      - ["BloombergLP::bdlb", "VariantImp", False, "operator=", "(const VariantImp &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]

cpp/ql/lib/ext/bdlb.values.model.yml:21

• The move-assignment model similarly omits flow to the returned VariantImp&, so chained reads from the assignment result are not modeled. Add a parallel ReturnValue[*].Element[@] output for the move signature.

      - ["BloombergLP::bdlb", "VariantImp", False, "operator=", "(VariantImp &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]

• Files reviewed: 9/10 changed files
• Comments generated: 2
• Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

🟡 Changes recommended

The summaries omit valid pointer conversions and several C++ scalar emplacement categories.

Get a fresh assessment by requesting another Copilot review.

Suppressed comments (1)

cpp/ql/lib/semmle/code/cpp/models/implementations/BdlbValues.qll:88

• The advertised scalar-emplacement model currently omits several C++ scalar categories. In particular, an exact enum payload is neither ArithmeticType nor PointerType, so NullableValue<MyEnum>::makeValueInplace(sourceEnum()) and the corresponding variant call get no summary even though no user-defined conversion is involved. Include enums (and the other scalar pointer/null categories) or narrow the documented scope.

    (inputType instanceof ArithmeticType or inputType instanceof PointerType) and
    storedType =
      this.getType().getUnspecifiedType().(ReferenceType).getBaseType().getUnspecifiedType() and
    (storedType instanceof ArithmeticType or storedType instanceof PointerType) and

• Files reviewed: 11/12 changed files
• Comments generated: 1
• Review effort level: Balanced