C#: Data flow for positional patterns. by michaelnebel · Pull Request #22689 · github/codeql

michaelnebel · 2026-09-28T13:51:54Z

In this PR we add data flow support via positional patterns. That is,

var x = (1, (2, 3), 4);
switch (x)
{
    case (var a1, (var b1, var c1), _):
        Sink(a1);        // has value flow 1
        Sink(c1);        // has value flow 3
        Sink(b1);       // has value flow 2.
        break;
}

Note, that positional patterns are similar to tuple patterns (var (x, y)), but they haven't been handled in the data flow library before now.

DCA looks good.

…rns into the readStepPattern predicate.

Copilot

Copilot review overview

🟡 Changes recommended

Nested positional patterns that capture the whole inner tuple still lose flow to the capture variable.

Review effort: Balanced
Findings: 1

Open (1)

Nested positional patterns miss whole-tuple capture flow · New

What changed in this PR

Adds tuple-backed positional-pattern support to C# data-flow analysis, including nested patterns.

Changes:

Models flow through positional patterns in is expressions and switch cases.
Adds nested-pattern tests and updates generated expectations.
Documents the analysis improvement.

File	Description
csharp/ql/test/library-tests/dataflow/tuples/Tuples.expected	Updates expected flow results.
csharp/ql/test/library-tests/dataflow/tuples/Tuples.cs	Adds nested positional-pattern tests.
csharp/ql/test/library-tests/dataflow/tuples/PrintAst.expected	Updates expected test syntax trees.
csharp/ql/test/library-tests/dataflow/tuples/DataFlowStep.expected	Updates expected flow steps.
csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll	Adds positional-pattern flow modeling.
csharp/ql/lib/change-notes/2026-10-02-positional-pattern-flow.md	Documents the new support.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

hvitved

LGTM, but did you consider modeling this as calls to Deconstruct? Then we would have to define MaD models for tuple deconstruct methods.

michaelnebel · 2026-10-05T12:36:49Z

LGTM, but did you consider modeling this as calls to Deconstruct? Then we would have to define MaD models for tuple deconstruct methods.

No, I must admit, that I didn't consider it. Deconstruction also applies for other cases (like var (x,y) = r) and tuple pattern matching in general, and I wanted to get a working implementation for pattern matching without also changing the existing implementation.
If time allows it, I will look into generalizing using Deconstruction. Is that acceptable?

github-actions Bot added C# documentation labels Sep 28, 2026

michaelnebel changed the title ~~Csharp/positionalpatternflow~~ C#: Data flow for positional patterns. Sep 29, 2026

michaelnebel force-pushed the csharp/positionalpatternflow branch from 84d670d to f059beb Compare September 30, 2026 12:22

github-actions Bot removed the documentation label Sep 30, 2026

C#: Add some positional pattern data flow tests.

6e44cf9

michaelnebel force-pushed the csharp/positionalpatternflow branch from f059beb to f3eaab2 Compare October 2, 2026 08:17

michaelnebel added 4 commits October 2, 2026 11:15

C#: Make positional pattern read step.

fc6eb67

C#: Update test expected output.

6ecc8f3

C#: Refactor the tuple read step logic that is only relevant to patte…

21dde8a

…rns into the readStepPattern predicate.

C#: Add change-note.

ae1c4ad

michaelnebel force-pushed the csharp/positionalpatternflow branch from f3eaab2 to ae1c4ad Compare October 2, 2026 09:21

github-actions Bot added the documentation label Oct 2, 2026

michaelnebel requested a balanced review from Copilot October 2, 2026 11:55

Copilot started reviewing on behalf of michaelnebel October 2, 2026 11:55 View session

Copilot AI reviewed Oct 2, 2026

View reviewed changes

Comment thread csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll Outdated

michaelnebel added 3 commits October 2, 2026 15:09

C#: Add positional pattern with missing flow.

d6fb7d3

C#: Address review comments.

2e0d38f

C#: Update expected test output.

4e4e84a

michaelnebel requested a review from hvitved October 5, 2026 09:00

michaelnebel marked this pull request as ready for review October 5, 2026 09:00

michaelnebel requested a review from a team as a code owner October 5, 2026 09:00

hvitved approved these changes Oct 5, 2026

View reviewed changes

michaelnebel merged commit 1d349af into github:main Oct 5, 2026
24 checks passed

Navigation Menu

C#: Data flow for positional patterns. - #22689

C#: Data flow for positional patterns.#22689
michaelnebel merged 8 commits into
github:mainfrom
michaelnebel:csharp/positionalpatternflow

michaelnebel commented Sep 28, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

hvitved left a comment

Uh oh!

michaelnebel commented Oct 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

michaelnebel commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

hvitved left a comment

Choose a reason for hiding this comment

Uh oh!

michaelnebel commented Oct 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

michaelnebel commented Sep 28, 2026 •

edited

Loading