C++: Model BDE bal codec taint flow

Add flow summaries for the balber, baljsn and balxml codecs. decode and
decodeAny move taint from the stream into the decoded object; encode and
encodeAny move it from the object into the stream. balber and baljsn have
a uniform argument layout across overloads and return an int status, so
their rows carry no signature. balxml overloads differ in layout and two
of them return the stream they were given, so each balxml row names its
overload and the istream/ostream forms also get ReturnValue[*] rows.

Not modelled: balxml::Decoder::decode(const char *filename, TYPE *), the
two-step open() + decode(TYPE *) form, and the Formatter overloads of
balxml::Encoder.

Author: kumarak

cpp/ql/lib/change-notes/2026-09-09-bal-codec-models.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added flow summaries for the BDE codecs `BloombergLP::balber::BerDecoder`/`BerEncoder`, `BloombergLP::baljsn::Decoder`/`Encoder` and `BloombergLP::balxml::Decoder`/`Encoder`.

cpp/ql/lib/ext/balber.model.yml

@@ -0,0 +1,14 @@
+# Model of the BDE balber BER (X.690) codec (BloombergLP::balber).
+# Decoding moves taint from the byte stream into the decoded object; encoding moves it from
+# the object into the byte stream. Every overload of these members takes the stream at
+# argument 0 and the object at argument 1 and returns an int status, so the rows need no
+# signature and there are no fluent ReturnValue rows.
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
+      - ["BloombergLP::balber", "BerDecoder", true, "decode", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
+      - ["BloombergLP::balber", "BerDecoder", true, "decodeAny", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
+      - ["BloombergLP::balber", "BerEncoder", true, "encode", "", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::balber", "BerEncoder", true, "encodeAny", "", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]

cpp/ql/lib/ext/baljsn.model.yml

@@ -0,0 +1,15 @@
+# Model of the BDE baljsn JSON codec (BloombergLP::baljsn).
+# Decoding moves taint from the byte stream into the decoded object; encoding moves it from
+# the object into the byte stream. Every overload of these members, including the ones that
+# take a trailing DecoderOptions/EncoderOptions, has the stream at argument 0 and the object
+# at argument 1 and returns an int status, so the rows need no signature and there are no
+# fluent ReturnValue rows.
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
+      - ["BloombergLP::baljsn", "Decoder", true, "decode", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
+      - ["BloombergLP::baljsn", "Decoder", true, "decodeAny", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
+      - ["BloombergLP::baljsn", "Encoder", true, "encode", "", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::baljsn", "Encoder", true, "encodeAny", "", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]

cpp/ql/lib/ext/balxml.model.yml

@@ -0,0 +1,39 @@
+# Model of the BDE balxml XML codec (BloombergLP::balxml).
+# Decoding moves taint from the byte stream into the decoded object; encoding moves it from
+# the object into the byte stream. Unlike balber and baljsn, the overloads here differ in
+# argument layout, so every row names its overload. The istream/ostream overloads of
+# decode/decodeAny/encode/encodeAny return the stream they were given, which is modelled
+# with ReturnValue[*] rows.
+#
+# Not modelled: decode(const char *filename, TYPE *) (its input is a path, not data);
+# the two-step open(...) followed by decode(TYPE *) / decodeAny(TYPE *) form, which would
+# require stashing taint on the decoder; and the encode/encodeAny(Formatter &, ...) overloads.
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
+      # Decoder: stream -> object
+      - ["BloombergLP::balxml", "Decoder", true, "decode<TYPE>", "(istream &,TYPE *,const char *)", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Decoder", true, "decode<TYPE>", "(istream &,TYPE *,const char *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Decoder", true, "decode<TYPE>", "(streambuf *,TYPE *,const char *)", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Decoder", true, "decode<TYPE>", "(const char *,size_t,TYPE *,const char *)", "", "Argument[*0]", "Argument[*2]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Decoder", true, "decodeAny<TYPE>", "(istream &,TYPE *,const char *)", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Decoder", true, "decodeAny<TYPE>", "(istream &,TYPE *,const char *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Decoder", true, "decodeAny<TYPE>", "(streambuf *,TYPE *,const char *)", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Decoder", true, "decodeAny", "(istream &,AnyRef *,const char *)", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Decoder", true, "decodeAny", "(istream &,AnyRef *,const char *)", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Decoder", true, "decodeAny", "(streambuf *,AnyRef *,const char *)", "", "Argument[*0]", "Argument[*1]", "taint", "manual"]
+      # Encoder: object -> stream
+      - ["BloombergLP::balxml", "Encoder", true, "encode<TYPE>", "(streambuf *,const TYPE &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Encoder", true, "encode<TYPE>", "(ostream &,const TYPE &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Encoder", true, "encode<TYPE>", "(ostream &,const TYPE &)", "", "Argument[*0..1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Encoder", true, "encodeToStream<TYPE>", "(ostream &,const TYPE &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Encoder", true, "encodeAny<TYPE>", "(streambuf *,const TYPE &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Encoder", true, "encodeAny<TYPE>", "(ostream &,const TYPE &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Encoder", true, "encodeAny<TYPE>", "(ostream &,const TYPE &)", "", "Argument[*0..1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Encoder", true, "encodeAnyToStream<TYPE>", "(ostream &,const TYPE &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Encoder", true, "encodeAny", "(streambuf *,const AnyConstRef &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Encoder", true, "encodeAny", "(ostream &,const AnyConstRef &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Encoder", true, "encodeAny", "(ostream &,const AnyConstRef &)", "", "Argument[*0..1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::balxml", "Encoder", true, "encodeAnyToStream", "(ostream &,const AnyConstRef &)", "", "Argument[*1]", "Argument[*0]", "taint", "manual"]