cpp: model BDE nullable and variant contents

[kumarak]

Adds contained-value flow models for BDE bdlb::NullableValue and the bdlb::Variant family.

Covers accessors (value, the, valueOr, addressOr, valueOrNull), makeValue / assign, same-specialization copy and move operations, allocator-extended constructors, and single-argument arithmetic, enum, and pointer emplacement.

Simple reads use YAML summaries; type-dependent flow and write-back through returned references/pointers use QL summaries. Inherited optional operators are handled separately in #22582.

Class-typed and multi-argument emplacement, engagement state, and C++03 move emulation are outside this change.

[Copilot]

🟡 Changes recommended

Several summaries lose flow through modifiable return references and assignment results.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds contained-value flow modeling for BDE nullable and variant wrappers.

Changes:

• Adds type-aware assignment and emplacement summaries.
• Models accessors, copying, moving, and reference writes.
• Adds data-flow tests and release documentation.

File summaries

File	Description
cpp/ql/lib/semmle/code/cpp/models/Models.qll	Registers the new implementation.
cpp/ql/lib/semmle/code/cpp/models/implementations/BdlbValues.qll	Implements assignment and emplacement summaries.
cpp/ql/lib/ext/bdlb.values.model.yml	Declares accessor and copy/move models.
cpp/ql/lib/change-notes/2026-09-14-bdlb-values.md	Documents the analysis improvement.
cpp/ql/test/library-tests/dataflow/bdlb-values/wrappers.h	Defines reduced BDE test APIs.
cpp/ql/test/library-tests/dataflow/bdlb-values/test.cpp	Tests wrapper data flow.
cpp/ql/test/library-tests/dataflow/bdlb-values/emplacement.cpp	Tests constructor-body analysis.
cpp/ql/test/library-tests/dataflow/bdlb-values/flow.ql	Configures the flow test.
cpp/ql/test/library-tests/dataflow/bdlb-values/flow.expected	Records expected results.
cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected	Updates model-validation expectations.

Review details

Suppressed comments (4)

cpp/ql/lib/semmle/code/cpp/models/implementations/BdlbValues.qll:85

• Both emplacement APIs return a modifiable reference to the newly stored value, but this summary has no return-to-wrapper edge. Consequently, writes such as n.makeValueInplace(0) = source() or v.createInPlace<int>(0) = source() are lost when the wrapper is read later. Add the same reverse paths used for value()/the().

      output = ["Argument[-1].Element[" + stars + "]", "ReturnValue[*" + stars + "]"]

cpp/ql/lib/ext/bdlb.values.model.yml:14

• The move-assignment summary does not propagate the moved contents to the returned NullableValue&, so chained reads from (dst = move(src)) miss flow. Add a parallel ReturnValue[*].Element[@] output for this signature.

      - ["BloombergLP::bdlb", "NullableValue", False, "operator=", "(NullableValue &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]

cpp/ql/lib/ext/bdlb.values.model.yml:19

• The copy-assignment model omits flow to the returned VariantImp&. As a result, reading the contained value through (dst = src) loses the copied taint even though the returned reference aliases dst. Add the corresponding return-value element summary.

      - ["BloombergLP::bdlb", "VariantImp", False, "operator=", "(const VariantImp &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]

cpp/ql/lib/ext/bdlb.values.model.yml:21

• The move-assignment model similarly omits flow to the returned VariantImp&, so chained reads from the assignment result are not modeled. Add a parallel ReturnValue[*].Element[@] output for the move signature.

      - ["BloombergLP::bdlb", "VariantImp", False, "operator=", "(VariantImp &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]

• Files reviewed: 9/10 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The summaries omit valid pointer conversions and several C++ scalar emplacement categories.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

cpp/ql/lib/semmle/code/cpp/models/implementations/BdlbValues.qll:88

• The advertised scalar-emplacement model currently omits several C++ scalar categories. In particular, an exact enum payload is neither ArithmeticType nor PointerType, so NullableValue<MyEnum>::makeValueInplace(sourceEnum()) and the corresponding variant call get no summary even though no user-defined conversion is involved. Include enums (and the other scalar pointer/null categories) or narrow the documented scope.

    (inputType instanceof ArithmeticType or inputType instanceof PointerType) and
    storedType =
      this.getType().getUnspecifiedType().(ReferenceType).getBaseType().getUnspecifiedType() and
    (storedType instanceof ArithmeticType or storedType instanceof PointerType) and

• Files reviewed: 11/12 changed files
• Comments generated: 1
• Review effort level: Balanced