[MathiasVP]

Consider a type such as:

template<typename T>
struct Container {
  template<typename... Args>
  void insert(Args...&& args);
};

We can model the fact that insert creates a T object and inserts it into a value of type Container by using a forwards model like:

- addsTo:
      pack: codeql/cpp-all
      extensible: forwardsModel
    data:
      - ["", "Container<T>", True, "insert<Args>", "(Args)", "", "0", "T", "Argument[-1].Element", "manual"]

However, the value to construct can be more complex to identify than just the type name T. For example, std::map constructs a value of type std::pair<const Key, T>. And there's currently no way to identify such a complex type in the interpretation of the forwards rows (nor do I think we should add support for identifying such complex types!)

Instead, this PR makes it possible to simplify use the name of the nested type in the forwards model. For example, if we have:

template<typename T>
struct Container {
  using value_type = Wrapper<T>;

  template<typename... Args>
  void insert(Args...&& args);
};

then we can model the fact that insert creates a Wrapper<T> object and inserts it into a value of type Container by using a forwards model like:

- addsTo:
      pack: codeql/cpp-all
      extensible: forwardsModel
    data:
      - ["", "Container<T>", True, "insert<Args>", "(Args)", "", "0", "value_type", "Argument[-1].Element", "manual"]

Since we already had a suitable testcase for this I simply added a typedef and reused the existing testcase.

We still don't have any non-test forwards models. So I don't think this PR needs a DCA run.

[Copilot]

🟡 Changes recommended

Stale expected-result files will fail fixture comparisons, and unresolved inherited value_type aliases can cause forwarding flows to be missed.

2 open issues

• Regenerate expected results for updated fixtures · New
• Resolve inherited aliases for derived forwarding methods · New

What changed in this PR

This PR extends C++ model-as-data forwarding models to identify constructed types through nested aliases, avoiding the need to express complex template types directly in model rows.

Changes:

• Resolve named typedef members on the forwarding function’s declaring type.
• Update the container forwarding model to use value_type.
• Add scalar and pointer cases to the existing data-flow fixture.

File	Description
cpp/​ql/​test/​library-tests/​dataflow/​external-models/​test.cpp	Adds value_type and scalar/pointer forwarding cases.
cpp/​ql/​test/​library-tests/​dataflow/​external-models/​flow.ext.yml	Switches the container model from T to value_type.
cpp/​ql/​lib/​semmle/​code/​cpp/​dataflow/​ExternalFlow.qll	Adds nested typedef resolution for constructed types.

_{Review effort: Balanced (auto)}

[jketema]

LGTM. One little nit.

[jketema]

Nit: Indentation looks a bit funny here.

[MathiasVP]

Oops. I agree. I'll fix in a subsequent PR