Merge pull request #264 from microsoft/simple-type-sanitizers

MathiasVP · web-flow · commit f8bdfa4666b1 · 2025-07-25T11:41:01.000+01:00
PS: Add simple type-based sanitizer to SQL injection query
diff --git a/powershell/ql/lib/semmle/code/powershell/ApiGraphs.qll b/powershell/ql/lib/semmle/code/powershell/ApiGraphs.qll
@@ -563,15 +563,15 @@ module API {
         )
         or
         exists(DataFlow::AutomaticVariableNode automatic |
-          automatic.getName() = name and
+          automatic.getLowerCaseName() = name and
           succ = getForwardStartNode(automatic)
         )
         or
         succ = getAnImplicitRootMember(name)
       )
       or
       exists(DataFlow::QualifiedTypeNameNode typeName |
-        typeName.getName() = name and
+        typeName.getLowerCaseName() = name and
         pred = MkNamespaceOfTypeNameNode(typeName) and
         succ = getForwardStartNode(typeName)
       )
diff --git a/powershell/ql/lib/semmle/code/powershell/ast/internal/AutomaticVariable.qll b/powershell/ql/lib/semmle/code/powershell/ast/internal/AutomaticVariable.qll
@@ -1,11 +1,15 @@
 private import AstImport
 
 class AutomaticVariable extends Expr, TAutomaticVariable {
-  final override string toString() { result = this.getName() }
+  final override string toString() { result = this.getLowerCaseName() }
 
-  string getName() { any(Synthesis s).automaticVariableName(this, result) }
+  string getLowerCaseName() { any(Synthesis s).automaticVariableName(this, result) }
+
+  bindingset[result]
+  pragma[inline_late]
+  string getAName() { result.toLowerCase() = this.getLowerCaseName() }
 }
 
 class MyInvocation extends AutomaticVariable {
-  MyInvocation() { this.getName() = "myinvocation" }
+  MyInvocation() { this.getLowerCaseName() = "myinvocation" }
 }
diff --git a/powershell/ql/lib/semmle/code/powershell/ast/internal/InvokeMemberExpression.qll b/powershell/ql/lib/semmle/code/powershell/ast/internal/InvokeMemberExpression.qll
@@ -71,8 +71,13 @@ class ConstructorCall extends InvokeMemberExpr {
     this.isStatic() and typename = this.getQualifier() and this.getLowerCaseName() = "new"
   }
 
+  /** Gets a name of the type being constructed by this constructor call. */
+  bindingset[result]
+  pragma[inline_late]
+  string getAConstructedTypeName() { result = typename.getAName() }
+
   /** Gets the name of the type being constructed by this constructor call. */
-  string getConstructedTypeName() { result = typename.getName() }
+  string getLowerCaseConstructedTypeName() { result = typename.getLowerCaseName() }
 }
 
 /**
diff --git a/powershell/ql/lib/semmle/code/powershell/ast/internal/ObjectCreation.qll b/powershell/ql/lib/semmle/code/powershell/ast/internal/ObjectCreation.qll
@@ -2,7 +2,11 @@ import powershell
 
 abstract private class AbstractObjectCreation extends CallExpr {
   /** The name of the type of the object being constructed. */
-  abstract string getConstructedTypeName();
+  bindingset[result]
+  pragma[inline_late]
+  string getAConstructedTypeName() { result.toLowerCase() = this.getLowerCaseConstructedTypeName() }
+
+  abstract string getLowerCaseConstructedTypeName();
 
   abstract Expr getConstructedTypeExpr();
 }
@@ -14,8 +18,14 @@ abstract private class AbstractObjectCreation extends CallExpr {
  * ```
  */
 class NewObjectCreation extends AbstractObjectCreation, ConstructorCall {
-  final override string getConstructedTypeName() {
-    result = ConstructorCall.super.getConstructedTypeName()
+  final override string getLowerCaseConstructedTypeName() {
+    result = ConstructorCall.super.getLowerCaseConstructedTypeName()
+  }
+
+  bindingset[result]
+  pragma[inline_late]
+  final override string getAConstructedTypeName() {
+    result = ConstructorCall.super.getAConstructedTypeName()
   }
 
   final override Expr getConstructedTypeExpr() { result = typename }
@@ -30,8 +40,8 @@ class NewObjectCreation extends AbstractObjectCreation, ConstructorCall {
 class DotNetObjectCreation extends AbstractObjectCreation, CmdCall {
   DotNetObjectCreation() { this.getLowerCaseName() = "new-object" }
 
-  final override string getConstructedTypeName() {
-    result = this.getConstructedTypeExpr().(StringConstExpr).getValueString()
+  final override string getLowerCaseConstructedTypeName() {
+    result = this.getConstructedTypeExpr().(StringConstExpr).getValueString().toLowerCase()
   }
 
   final override Expr getConstructedTypeExpr() {
diff --git a/powershell/ql/lib/semmle/code/powershell/ast/internal/Raw/NamedAttributeArgument.qll b/powershell/ql/lib/semmle/code/powershell/ast/internal/Raw/NamedAttributeArgument.qll
@@ -15,9 +15,11 @@ class NamedAttributeArgument extends @named_attribute_argument, Ast {
 }
 
 class ValueFromPipelineAttribute extends NamedAttributeArgument {
-  ValueFromPipelineAttribute() { this.getName() = "ValueFromPipeline" }
+  ValueFromPipelineAttribute() { this.getName().toLowerCase() = "valuefrompipeline" }
 }
 
 class ValueFromPipelineByPropertyName extends NamedAttributeArgument {
-  ValueFromPipelineByPropertyName() { this.getName() = "ValueFromPipelineByPropertyName" }
+  ValueFromPipelineByPropertyName() {
+    this.getName().toLowerCase() = "valuefrompipelinebypropertyname"
+  }
 }
diff --git a/powershell/ql/lib/semmle/code/powershell/ast/internal/Synthesis.qll b/powershell/ql/lib/semmle/code/powershell/ast/internal/Synthesis.qll
@@ -345,7 +345,7 @@ private module ParameterSynth {
         // has a static type.
         this.parameter(parent, i, p, _) and
         n = TVariableSynth(parent, i) and
-        type = p.getStaticType()
+        type = p.getStaticType().toLowerCase()
       )
     }
   }
@@ -530,7 +530,7 @@ private module TypeSynth {
     override predicate typeName(Type t, string name) {
       exists(Raw::TypeStmt typeStmt |
         t = TTypeSynth(typeStmt, _) and
-        typeStmt.getName() = name
+        typeStmt.getName().toLowerCase() = name
       )
     }
 
diff --git a/powershell/ql/lib/semmle/code/powershell/ast/internal/TypeExpression.qll b/powershell/ql/lib/semmle/code/powershell/ast/internal/TypeExpression.qll
@@ -14,15 +14,21 @@ class TypeNameExpr extends Expr, TTypeNameExpr {
     )
   }
 
-  string getName() { this.parseName(_, result) }
+  string getLowerCaseName() { this.parseName(_, result) }
+
+  bindingset[result]
+  pragma[inline_late]
+  string getAName() { this.parseName(_, result.toLowerCase()) }
 
   /** If any */
-  string getPossiblyQualifiedName() { result = getRawAst(this).(Raw::TypeNameExpr).getName() }
+  string getPossiblyQualifiedName() {
+    result = getRawAst(this).(Raw::TypeNameExpr).getName().toLowerCase()
+  }
 
   // TODO: What to do when System is omitted?
   string getNamespace() { this.parseName(result, _) }
 
-  override string toString() { result = this.getName() }
+  override string toString() { result = this.getLowerCaseName() }
 
   predicate isQualified() { this.getNamespace() != "" }
 
diff --git a/powershell/ql/lib/semmle/code/powershell/controlflow/CfgNodes.qll b/powershell/ql/lib/semmle/code/powershell/controlflow/CfgNodes.qll
@@ -587,7 +587,15 @@ module ExprNodes {
 
     override ObjectCreation getExpr() { result = e }
 
-    string getConstructedTypeName() { result = this.getExpr().getConstructedTypeName() }
+    string getLowerCaseConstructedTypeName() {
+      result = this.getExpr().getLowerCaseConstructedTypeName()
+    }
+
+    bindingset[result]
+    pragma[inline_late]
+    string getAConstructedTypeName() {
+      result.toLowerCase() = this.getLowerCaseConstructedTypeName()
+    }
 
     ExprCfgNode getConstructedTypeExpr() {
       e.hasCfgChild(this.getExpr().getConstructedTypeExpr(), this, result)
@@ -717,7 +725,11 @@ module ExprNodes {
 
     override TypeNameExpr getExpr() { result = e }
 
-    string getName() { result = e.getName() }
+    bindingset[result]
+    pragma[inline_late]
+    string getAName() { result = e.getAName() }
+
+    string getLowerCaseName() { result = e.getLowerCaseName() }
 
     string getNamespace() { result = e.getNamespace() }
 
@@ -1118,7 +1130,11 @@ module ExprNodes {
 
     override AutomaticVariable getExpr() { result = e }
 
-    string getName() { result = e.getName() }
+    bindingset[result]
+    pragma[inline_late]
+    string getAName() { result = e.getAName() }
+
+    string getLowerCaseName() { result = e.getLowerCaseName() }
   }
 }
 
diff --git a/powershell/ql/lib/semmle/code/powershell/dataflow/internal/DataFlowDispatch.qll b/powershell/ql/lib/semmle/code/powershell/dataflow/internal/DataFlowDispatch.qll
@@ -159,10 +159,10 @@ private predicate localFlowStep(Node nodeFrom, Node nodeTo, StepSummary summary)
 
 private module TrackInstanceInput implements CallGraphConstruction::InputSig {
   private predicate start0(Node start, string typename, boolean exact) {
-    start.(ObjectCreationNode).getObjectCreationNode().getConstructedTypeName() = typename and
+    start.(ObjectCreationNode).getObjectCreationNode().getLowerCaseConstructedTypeName() = typename and
     exact = true
     or
-    start.asExpr().(CfgNodes::ExprNodes::TypeNameExprCfgNode).getName() = typename and
+    start.asExpr().(CfgNodes::ExprNodes::TypeNameExprCfgNode).getLowerCaseName() = typename and
     exact = true
     or
     start.asParameter().getStaticType() = typename and
diff --git a/powershell/ql/lib/semmle/code/powershell/dataflow/internal/DataFlowPublic.qll b/powershell/ql/lib/semmle/code/powershell/dataflow/internal/DataFlowPublic.qll
@@ -495,7 +495,11 @@ class ObjectCreationNode extends ExprNode {
    */
   Node getConstructedTypeNode() { result.asExpr() = objectCreation.getConstructedTypeExpr() }
 
-  string getConstructedTypeName() { result = this.getObjectCreationNode().getConstructedTypeName() }
+  bindingset[result]
+  pragma[inline_late]
+  string getAConstructedTypeName() {
+    result = this.getObjectCreationNode().getAConstructedTypeName()
+  }
 }
 
 /** A call, viewed as a node in a data flow graph. */
@@ -567,7 +571,11 @@ class TypeNameNode extends ExprNode {
 
   override CfgNodes::ExprNodes::TypeNameExprCfgNode getExprNode() { result = n }
 
-  string getName() { result = n.getName() }
+  bindingset[result]
+  pragma[inline_late]
+  string getAName() { result = n.getAName() }
+
+  string getLowerCaseName() { result = n.getLowerCaseName() }
 
   predicate isQualified() { n.isQualified() }
 
@@ -593,5 +601,9 @@ class AutomaticVariableNode extends ExprNode {
 
   final override CfgNodes::ExprNodes::AutomaticVariableCfgNode getExprNode() { result = n }
 
-  string getName() { result = n.getName() }
+  bindingset[result]
+  pragma[inline_late]
+  string getAName() { result = n.getAName() }
+
+  string getLowerCaseName() { result = n.getLowerCaseName() }
 }
diff --git a/powershell/ql/lib/semmle/code/powershell/frameworks/PowerShell.qll b/powershell/ql/lib/semmle/code/powershell/frameworks/PowerShell.qll
@@ -6,7 +6,7 @@ module PowerShell {
   private class PowerShellGlobalEntry extends ModelInput::TypeModel {
     override DataFlow::Node getASource(string type) {
       type = "System.Management.Automation.PowerShell!" and
-      result.asExpr().getExpr().(TypeNameExpr).getName().toLowerCase() = "powershell"
+      result.asExpr().getExpr().(TypeNameExpr).getLowerCaseName() = "powershell"
     }
   }
 }
diff --git a/powershell/ql/lib/semmle/code/powershell/frameworks/Runspaces.qll b/powershell/ql/lib/semmle/code/powershell/frameworks/Runspaces.qll
@@ -6,7 +6,7 @@ module RunspaceFactory {
   private class RunspaceFactoryGlobalEntry extends ModelInput::TypeModel {
     override DataFlow::Node getASource(string type) {
       type = "System.Management.Automation.Runspaces.RunspaceFactory!" and
-      result.asExpr().getExpr().(TypeNameExpr).getName().toLowerCase() = "runspacefactory"
+      result.asExpr().getExpr().(TypeNameExpr).getLowerCaseName() = "runspacefactory"
     }
   }
 }
diff --git a/powershell/ql/lib/semmle/code/powershell/security/CommandInjectionCustomizations.qll b/powershell/ql/lib/semmle/code/powershell/security/CommandInjectionCustomizations.qll
@@ -103,7 +103,7 @@ module CommandInjection {
         addscript.matchesName("AddScript") and
         create.matchesName("Create") and
         addscript.getQualifier().(InvokeMemberExpr) = create and
-        create.getQualifier().(TypeNameExpr).getName() = "PowerShell"
+        create.getQualifier().(TypeNameExpr).getAName() = "PowerShell"
       )
     }
 
@@ -164,7 +164,7 @@ module CommandInjection {
       exists(InvokeMemberExpr ie |
         this.asExpr().getExpr() = ie.getAnArgument() and
         ie.matchesName("Create") and
-        ie.getQualifier().(TypeNameExpr).getName() = "ScriptBlock"
+        ie.getQualifier().(TypeNameExpr).getAName() = "ScriptBlock"
       )
     }
 
@@ -212,7 +212,7 @@ module CommandInjection {
     TypedParameterSanitizer() {
       exists(Function f, Parameter p |
         p = f.getAParameter() and
-        p.getStaticType() != "Object" and
+        p.getStaticType() != "object" and
         this.asParameter() = p
       )
     }
diff --git a/powershell/ql/lib/semmle/code/powershell/security/Sanitizers.qll b/powershell/ql/lib/semmle/code/powershell/security/Sanitizers.qll
@@ -0,0 +1,14 @@
+private import powershell
+private import semmle.code.powershell.dataflow.DataFlow
+
+/**
+ * A dataflow node that is guarenteed to have a "simple" type.
+ *
+ * Simple types include integers, floats, characters, booleans, and `datetime`.
+ */
+class SimpleTypeSanitizer extends DataFlow::Node {
+  SimpleTypeSanitizer() {
+    this.asParameter().getStaticType() =
+      ["int32", "int64", "single", "double", "decimal", "char", "boolean", "datetime"]
+  }
+}
diff --git a/powershell/ql/lib/semmle/code/powershell/security/SqlInjectionCustomizations.qll b/powershell/ql/lib/semmle/code/powershell/security/SqlInjectionCustomizations.qll
@@ -8,6 +8,7 @@ private import semmle.code.powershell.dataflow.DataFlow
 import semmle.code.powershell.ApiGraphs
 private import semmle.code.powershell.dataflow.flowsources.FlowSources
 private import semmle.code.powershell.Cfg
+private import semmle.code.powershell.security.Sanitizers
 
 module SqlInjection {
   /**
@@ -99,4 +100,6 @@ module SqlInjection {
 
     override string getSinkType() { result = "call to sqlcmd" }
   }
+
+  class TypeSanitizer extends Sanitizer instanceof SimpleTypeSanitizer { }
 }
diff --git a/powershell/ql/test/library-tests/ast/Expressions/expressions.expected b/powershell/ql/test/library-tests/ast/Expressions/expressions.expected
@@ -15,5 +15,5 @@ invokeMemoryExpression
 expandableString
 | ExpandableString.ps1:1:1:1:39 | Date: $([DateTime]::Now)\nName: $name | 1 | ExpandableString.ps1:1:21:1:38 | $(...) |
 memberExpr
-| ExpandableString.ps1:1:23:1:37 | now | ExpandableString.ps1:1:23:1:32 | DateTime |
-| MemberExpression.ps1:2:1:2:14 | ... | MemberExpression.ps1:2:1:2:10 | DateTime |
+| ExpandableString.ps1:1:23:1:37 | now | ExpandableString.ps1:1:23:1:32 | datetime |
+| MemberExpression.ps1:2:1:2:14 | ... | MemberExpression.ps1:2:1:2:10 | datetime |
diff --git a/powershell/ql/test/library-tests/ast/parent.expected b/powershell/ql/test/library-tests/ast/parent.expected
@@ -229,7 +229,7 @@
 | Expressions/ExpandableString.ps1:1:1:1:39 | {...} | Expressions/ExpandableString.ps1:1:1:1:39 | toplevel function for ExpandableString.ps1 |
 | Expressions/ExpandableString.ps1:1:1:1:39 | {...} | Expressions/ExpandableString.ps1:1:1:1:39 | {...} |
 | Expressions/ExpandableString.ps1:1:21:1:38 | $(...) | Expressions/ExpandableString.ps1:1:1:1:39 | Date: $([DateTime]::Now)\nName: $name |
-| Expressions/ExpandableString.ps1:1:23:1:32 | DateTime | Expressions/ExpandableString.ps1:1:23:1:37 | now |
+| Expressions/ExpandableString.ps1:1:23:1:32 | datetime | Expressions/ExpandableString.ps1:1:23:1:37 | now |
 | Expressions/ExpandableString.ps1:1:23:1:37 | [Stmt] now | Expressions/ExpandableString.ps1:1:23:1:37 | {...} |
 | Expressions/ExpandableString.ps1:1:23:1:37 | now | Expressions/ExpandableString.ps1:1:23:1:37 | [Stmt] now |
 | Expressions/ExpandableString.ps1:1:23:1:37 | {...} | Expressions/ExpandableString.ps1:1:21:1:38 | $(...) |
@@ -238,7 +238,7 @@
 | Expressions/MemberExpression.ps1:1:1:2:14 | {...} | Expressions/MemberExpression.ps1:1:1:2:14 | toplevel function for MemberExpression.ps1 |
 | Expressions/MemberExpression.ps1:1:1:2:14 | {...} | Expressions/MemberExpression.ps1:1:1:2:14 | {...} |
 | Expressions/MemberExpression.ps1:1:7:1:8 | x | Expressions/MemberExpression.ps1:1:1:2:14 | {...} |
-| Expressions/MemberExpression.ps1:2:1:2:10 | DateTime | Expressions/MemberExpression.ps1:2:1:2:14 | ... |
+| Expressions/MemberExpression.ps1:2:1:2:10 | datetime | Expressions/MemberExpression.ps1:2:1:2:14 | ... |
 | Expressions/MemberExpression.ps1:2:1:2:14 | ... | Expressions/MemberExpression.ps1:2:1:2:14 | [Stmt] ... |
 | Expressions/MemberExpression.ps1:2:1:2:14 | [Stmt] ... | Expressions/MemberExpression.ps1:1:1:2:14 | {...} |
 | Expressions/MemberExpression.ps1:2:13:2:14 | x | Expressions/MemberExpression.ps1:2:1:2:14 | ... |
diff --git a/powershell/ql/test/library-tests/dataflow/typetracking/test.ps1 b/powershell/ql/test/library-tests/dataflow/typetracking/test.ps1
@@ -7,7 +7,7 @@ class MyClass {
 
 $myClass = [MyClass]::new("hello")
 
-Sink $myClass # $ type=MyClass
+Sink $myClass # $ type=myclass
 
 
 $withNamedArg = New-Object -TypeName PSObject
diff --git a/powershell/ql/test/query-tests/security/cwe-089/test.ps1 b/powershell/ql/test/query-tests/security/cwe-089/test.ps1
@@ -78,4 +78,32 @@ $QueryConn2 = @{
     Query = $userinput
 }
 
-Invoke-Sqlcmd @QueryConn2 # BAD
+Invoke-Sqlcmd @QueryConn2 # BAD
+
+function TakesTypedParameters([int]$i, [long]$l, [float]$f, [double]$d, [decimal]$dec, [char]$c, [bool]$b, [datetime]$dt) {
+    $query1 = "SELECT * FROM MyTable WHERE MyColumn = '$i'"
+    Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query1 # GOOD
+
+    $query2 = "SELECT * FROM MyTable WHERE MyColumn = '$l'"
+    Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query2 # GOOD
+
+    $query3 = "SELECT * FROM MyTable WHERE MyColumn = '$f'"
+    Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query3 # GOOD
+
+    $query4 = "SELECT * FROM MyTable WHERE MyColumn = '$d'"
+    Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query4 # GOOD
+
+    $query5 = "SELECT * FROM MyTable WHERE MyColumn = '$dec'"
+    Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query5 # GOOD
+
+    $query6 = "SELECT * FROM MyTable WHERE MyColumn = '$c'"
+    Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query6 # GOOD
+
+    $query7 = "SELECT * FROM MyTable WHERE MyColumn = '$b'"
+    Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query7 # GOOD
+
+    $query8 = "SELECT * FROM MyTable WHERE MyColumn = '$dt'"
+    Invoke-Sqlcmd -ServerInstance "MyServer" -Database "MyDatabase" -Query $query8 # GOOD
+}
+
+TakesTypedParameters $userinput $userinput $userinput $userinput $userinput $userinput $userinput $userinput

Original file line number	Diff line number	Diff line change
`@@ -563,15 +563,15 @@ module API {`
`563`	`563`	`)`
`564`	`564`	`or`
`565`	`565`	`exists(DataFlow::AutomaticVariableNode automatic \|`
`566`		`- automatic.getName() = name and`
	`566`	`+ automatic.getLowerCaseName() = name and`
`567`	`567`	`succ = getForwardStartNode(automatic)`
`568`	`568`	`)`
`569`	`569`	`or`
`570`	`570`	`succ = getAnImplicitRootMember(name)`
`571`	`571`	`)`
`572`	`572`	`or`
`573`	`573`	`exists(DataFlow::QualifiedTypeNameNode typeName \|`
`574`		`- typeName.getName() = name and`
	`574`	`+ typeName.getLowerCaseName() = name and`
`575`	`575`	`pred = MkNamespaceOfTypeNameNode(typeName) and`
`576`	`576`	`succ = getForwardStartNode(typeName)`
`577`	`577`	`)`
Original file line number	Diff line number	Diff line change
`@@ -71,8 +71,13 @@ class ConstructorCall extends InvokeMemberExpr {`
`71`	`71`	`this.isStatic() and typename = this.getQualifier() and this.getLowerCaseName() = "new"`
`72`	`72`	`}`
`73`	`73`
	`74`	`+ /** Gets a name of the type being constructed by this constructor call. */`
	`75`	`+ bindingset[result]`
	`76`	`+ pragma[inline_late]`
	`77`	`+ string getAConstructedTypeName() { result = typename.getAName() }`
	`78`	`+`
`74`	`79`	`/** Gets the name of the type being constructed by this constructor call. */`
`75`		`- string getConstructedTypeName() { result = typename.getName() }`
	`80`	`+ string getLowerCaseConstructedTypeName() { result = typename.getLowerCaseName() }`
`76`	`81`	`}`
`77`	`82`
`78`	`83`	`/**`
Original file line number	Diff line number	Diff line change
`@@ -15,9 +15,11 @@ class NamedAttributeArgument extends @named_attribute_argument, Ast {`
`15`	`15`	`}`
`16`	`16`
`17`	`17`	`class ValueFromPipelineAttribute extends NamedAttributeArgument {`
`18`		`- ValueFromPipelineAttribute() { this.getName() = "ValueFromPipeline" }`
	`18`	`+ ValueFromPipelineAttribute() { this.getName().toLowerCase() = "valuefrompipeline" }`
`19`	`19`	`}`
`20`	`20`
`21`	`21`	`class ValueFromPipelineByPropertyName extends NamedAttributeArgument {`
`22`		`- ValueFromPipelineByPropertyName() { this.getName() = "ValueFromPipelineByPropertyName" }`
	`22`	`+ ValueFromPipelineByPropertyName() {`
	`23`	`+ this.getName().toLowerCase() = "valuefrompipelinebypropertyname"`
	`24`	`+ }`
`23`	`25`	`}`
Original file line number	Diff line number	Diff line change
`@@ -345,7 +345,7 @@ private module ParameterSynth {`
`345`	`345`	`// has a static type.`
`346`	`346`	`this.parameter(parent, i, p, _) and`
`347`	`347`	`n = TVariableSynth(parent, i) and`
`348`		`- type = p.getStaticType()`
	`348`	`+ type = p.getStaticType().toLowerCase()`
`349`	`349`	`)`
`350`	`350`	`}`
`351`	`351`	`}`
`@@ -530,7 +530,7 @@ private module TypeSynth {`
`530`	`530`	`override predicate typeName(Type t, string name) {`
`531`	`531`	`exists(Raw::TypeStmt typeStmt \|`
`532`	`532`	`t = TTypeSynth(typeStmt, _) and`
`533`		`- typeStmt.getName() = name`
	`533`	`+ typeStmt.getName().toLowerCase() = name`
`534`	`534`	`)`
`535`	`535`	`}`
`536`	`536`