diff --git a/cpp/ql/lib/change-notes/2026-07-23-std-regex-ecmascript-parser.md b/cpp/ql/lib/change-notes/2026-07-23-std-regex-ecmascript-parser.md
new file mode 100644
index 000000000000..8c1a4f8339a2
--- /dev/null
+++ b/cpp/ql/lib/change-notes/2026-07-23-std-regex-ecmascript-parser.md
@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added a C++ regular-expression parser for the ECMAScript grammar used by `std::regex`.
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 0d952a0c1bf9..04f48ffa72c5 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -10,6 +10,7 @@ dependencies:
   codeql/mad: ${workspace}
   codeql/quantum: ${workspace}
   codeql/rangeanalysis: ${workspace}
+  codeql/regex: ${workspace}
   codeql/ssa: ${workspace}
   codeql/typeflow: ${workspace}
   codeql/tutorial: ${workspace}
diff --git a/cpp/ql/lib/semmle/code/cpp/exprs/Literal.qll b/cpp/ql/lib/semmle/code/cpp/exprs/Literal.qll
index 31e2b5135b42..7238ea2a35ed 100644
--- a/cpp/ql/lib/semmle/code/cpp/exprs/Literal.qll
+++ b/cpp/ql/lib/semmle/code/cpp/exprs/Literal.qll
@@ -133,6 +133,19 @@ class StringLiteral extends TextLiteral {
   override string getAPrimaryQlClass() { result = "StringLiteral" }
 }
 
+/**
+ * A C++ raw string literal. For example:
+ * ```
+ * const char *s1 = R"(abcdef)";
+ * const wchar_t *s2 = LR"x(123456)x";
+ * ```
+ */
+class RawStringLiteral extends StringLiteral {
+  RawStringLiteral() { this.getValueText().regexpMatch("[^\"]*R\".*\\(.*") }
+
+  override string getAPrimaryQlClass() { result = "RawStringLiteral" }
+}
+
 /**
  * An octal literal. For example:
  * ```
diff --git a/cpp/ql/lib/semmle/code/cpp/regex/RegexTreeView.qll b/cpp/ql/lib/semmle/code/cpp/regex/RegexTreeView.qll
new file mode 100644
index 000000000000..cadb1e5d12c3
--- /dev/null
+++ b/cpp/ql/lib/semmle/code/cpp/regex/RegexTreeView.qll
@@ -0,0 +1,1226 @@
+/**
+ * Provides a class hierarchy corresponding to a parse tree of C++ regular expressions.
+ */
+
+private import internal.ParseRegExp
+private import codeql.util.Numbers
+private import semmle.code.cpp.exprs.Literal
+private import codeql.regex.RegexTreeView
+// exporting as RegexTreeView, and in the top-level scope.
+import Impl as RegexTreeView
+import Impl
+
+/** Gets the parse tree resulting from parsing `re`, if such has been constructed. */
+RegExpTerm getParsedRegExp(StringLiteral re) { result.getRegExp() = re and result.isRootTerm() }
+
+/**
+ * An element containing a regular expression term, that is, either
+ * a string literal (parsed as a regular expression)
+ * or another regular expression term.
+ *
+ * For sequences and alternations, we require at least one child.
+ * Otherwise, we wish to represent the term differently.
+ * This avoids multiple representations of the same term.
+ */
+private newtype TRegExpParent =
+  /** A string literal used as a regular expression */
+  TRegExpLiteral(RegExp re) or
+  /** A quantified term */
+  TRegExpQuantifier(RegExp re, int start, int end) { re.qualifiedItem(start, end, _, _) } or
+  /** A sequence term */
+  TRegExpSequence(RegExp re, int start, int end) { re.sequence(start, end) } or
+  /** An alternation term */
+  TRegExpAlt(RegExp re, int start, int end) { re.alternation(start, end) } or
+  /** A character class term */
+  TRegExpCharacterClass(RegExp re, int start, int end) { re.charSet(start, end) } or
+  /** A character range term */
+  TRegExpCharacterRange(RegExp re, int start, int end) { re.charRange(_, start, _, _, end) } or
+  /** A group term */
+  TRegExpGroup(RegExp re, int start, int end) { re.group(start, end) } or
+  /** A special character */
+  TRegExpSpecialChar(RegExp re, int start, int end) { re.specialCharacter(start, end, _) } or
+  /** A normal character */
+  TRegExpNormalChar(RegExp re, int start, int end) {
+    re.normalCharacterSequence(start, end)
+    or
+    re.escapedCharacter(start, end) and
+    not re.specialCharacter(start, end, _)
+  } or
+  /** A back reference */
+  TRegExpBackRef(RegExp re, int start, int end) { re.backreference(start, end) } or
+  /** A named character property */
+  TRegExpNamedCharacterProperty(RegExp re, int start, int end) {
+    re.namedCharacterProperty(start, end, _, _)
+  }
+
+/** An implementation that satisfies the RegexTreeView signature. */
+private module Impl implements RegexTreeViewSig {
+  /**
+   * An element containing a regular expression term, that is, either
+   * a string literal (parsed as a regular expression)
+   * or another regular expression term.
+   */
+  class RegExpParent extends TRegExpParent {
+    /** Gets a textual representation of this element. */
+    string toString() { result = "RegExpParent" }
+
+    /** Gets the `i`th child term. */
+    RegExpTerm getChild(int i) { none() }
+
+    /** Gets a child term . */
+    final RegExpTerm getAChild() { result = this.getChild(_) }
+
+    /** Gets the number of child terms. */
+    int getNumChild() { result = count(this.getAChild()) }
+
+    /** Gets the last child term of this element. */
+    RegExpTerm getLastChild() { result = this.getChild(this.getNumChild() - 1) }
+
+    /**
+     * Gets the name of a primary CodeQL class to which this regular
+     * expression term belongs.
+     */
+    string getAPrimaryQlClass() { result = "RegExpParent" }
+
+    /**
+     * Gets a comma-separated list of the names of the primary CodeQL classes to
+     * which this regular expression term belongs.
+     */
+    final string getPrimaryQlClasses() { result = concat(this.getAPrimaryQlClass(), ",") }
+  }
+
+  /** A string literal used as a regular expression */
+  class RegExpLiteral extends TRegExpLiteral, RegExpParent {
+    RegExp re;
+
+    RegExpLiteral() { this = TRegExpLiteral(re) }
+
+    override RegExpTerm getChild(int i) {
+      i = 0 and result.getRegExp() = re and result.isRootTerm()
+    }
+
+    /** Holds if dot, `.`, matches all characters, including newlines. */
+    predicate isDotAll() { re.isDotAll() }
+
+    /** Holds if this regex matching is case-insensitive for this regex. */
+    predicate isIgnoreCase() { re.isIgnoreCase() }
+
+    /** Get a string representing all modes for this regex. */
+    string getFlags() { result = re.getFlags() }
+
+    /** Gets the primary QL class for this regex. */
+    override string getAPrimaryQlClass() { result = "RegExpLiteral" }
+  }
+
+  /**
+   * A regular expression term, that is, a syntactic part of a regular expression.
+   */
+  class RegExpTerm extends RegExpParent {
+    RegExp re;
+    int start;
+    int end;
+
+    RegExpTerm() {
+      this = TRegExpAlt(re, start, end)
+      or
+      this = TRegExpBackRef(re, start, end)
+      or
+      this = TRegExpCharacterClass(re, start, end)
+      or
+      this = TRegExpCharacterRange(re, start, end)
+      or
+      this = TRegExpNormalChar(re, start, end)
+      or
+      this = TRegExpGroup(re, start, end)
+      or
+      this = TRegExpQuantifier(re, start, end)
+      or
+      this = TRegExpSequence(re, start, end) and
+      exists(seqChild(re, start, end, 1)) // if a sequence does not have more than one element, it should be treated as that element instead.
+      or
+      this = TRegExpSpecialChar(re, start, end)
+      or
+      this = TRegExpNamedCharacterProperty(re, start, end)
+    }
+
+    /**
+     * Gets the outermost term of this regular expression.
+     */
+    RegExpTerm getRootTerm() {
+      this.isRootTerm() and result = this
+      or
+      result = this.getParent().(RegExpTerm).getRootTerm()
+    }
+
+    /**
+     * Holds if this term is part of a string literal
+     * that is interpreted as a regular expression.
+     */
+    predicate isUsedAsRegExp() { any() }
+
+    /**
+     * Holds if this is the root term of a regular expression.
+     */
+    predicate isRootTerm() { start = 0 and end = re.getText().length() }
+
+    override RegExpTerm getChild(int i) {
+      result = this.(RegExpAlt).getChild(i)
+      or
+      result = this.(RegExpBackRef).getChild(i)
+      or
+      result = this.(RegExpCharacterClass).getChild(i)
+      or
+      result = this.(RegExpCharacterRange).getChild(i)
+      or
+      result = this.(RegExpNormalChar).getChild(i)
+      or
+      result = this.(RegExpGroup).getChild(i)
+      or
+      result = this.(RegExpQuantifier).getChild(i)
+      or
+      result = this.(RegExpSequence).getChild(i)
+      or
+      result = this.(RegExpSpecialChar).getChild(i)
+      or
+      result = this.(RegExpNamedCharacterProperty).getChild(i)
+    }
+
+    /**
+     * Gets the parent term of this regular expression term, or the
+     * regular expression literal if this is the root term.
+     */
+    RegExpParent getParent() { result.getAChild() = this }
+
+    /** Gets the associated `RegExp`. */
+    RegExp getRegExp() { result = re }
+
+    /** Gets the offset at which this term starts. */
+    int getStart() { result = start }
+
+    /** Gets the offset at which this term ends. */
+    int getEnd() { result = end }
+
+    override string toString() { result = re.getText().substring(start, end) }
+
+    /**
+     * Gets the location of the surrounding regex, as locations inside the regex do not exist.
+     * To get location information corresponding to the term inside the regex,
+     * use `hasLocationInfo`.
+     */
+    Location getLocation() { result = re.getLocation() }
+
+    /**
+     * Gets the number of source characters from the start of the string literal
+     * to the first content character (i.e., past the opening delimiter).
+     */
+    private int regexpContentOffset() {
+      exists(string vt | vt = re.getValueText() |
+        // Find the '(' that opens the raw content.
+        re instanceof RawStringLiteral and
+        result = 1 + min(int i | vt.charAt(i) = "(")
+        or
+        // Find the opening '"'.
+        not re instanceof RawStringLiteral and
+        result = 1 + min(int i | vt.charAt(i) = "\"")
+      )
+    }
+
+    /** Holds if this term is found at the specified location offsets. */
+    predicate hasLocationInfo(
+      string filepath, int startline, int startcolumn, int endline, int endcolumn
+    ) {
+      exists(int re_start, int offset |
+        re.getLocation().hasLocationInfo(filepath, startline, re_start, endline, _) and
+        offset = this.regexpContentOffset() and
+        startcolumn = re_start + offset + start and
+        endcolumn = re_start + offset + end - 1
+      )
+    }
+
+    /** Gets the file in which this term is found. */
+    File getFile() { result = this.getLocation().getFile() }
+
+    /** Gets the raw source text of this term. */
+    string getRawValue() { result = this.toString() }
+
+    /** Gets the string literal in which this term is found. */
+    RegExpLiteral getLiteral() { result = TRegExpLiteral(re) }
+
+    /** Gets the regular expression term that is matched (textually) before this one, if any. */
+    RegExpTerm getPredecessor() {
+      exists(RegExpTerm parent | parent = this.getParent() |
+        result = parent.(RegExpSequence).previousElement(this)
+        or
+        not exists(parent.(RegExpSequence).previousElement(this)) and
+        not parent instanceof RegExpSubPattern and
+        result = parent.getPredecessor()
+      )
+    }
+
+    /** Gets the regular expression term that is matched (textually) after this one, if any. */
+    RegExpTerm getSuccessor() {
+      exists(RegExpTerm parent | parent = this.getParent() |
+        result = parent.(RegExpSequence).nextElement(this)
+        or
+        not exists(parent.(RegExpSequence).nextElement(this)) and
+        not parent instanceof RegExpSubPattern and
+        result = parent.getSuccessor()
+      )
+    }
+
+    /**
+     * Gets the single string this regular-expression term matches.
+     *
+     * This predicate is only defined for (sequences/groups of) constant regular
+     * expressions.  In particular, terms involving zero-width assertions like `^`
+     * or `\b` are not considered to have a constant value.
+     *
+     * Note that this predicate does not take flags of the enclosing
+     * regular-expression literal into account.
+     */
+    string getConstantValue() { none() }
+
+    /**
+     * Gets a string that is matched by this regular-expression term.
+     */
+    string getAMatchedString() { result = this.getConstantValue() }
+
+    /** Gets the primary QL class for this term. */
+    override string getAPrimaryQlClass() { result = "RegExpTerm" }
+
+    /** Holds if this regular expression term can match the empty string. */
+    predicate isNullable() { none() }
+  }
+
+  /**
+   * A quantified regular expression term.
+   *
+   * Example:
+   *
+   * ```
+   * ((ECMA|Java)[sS]cript)*
+   * ```
+   */
+  class RegExpQuantifier extends RegExpTerm, TRegExpQuantifier {
+    int part_end;
+    boolean may_repeat_forever;
+
+    RegExpQuantifier() {
+      this = TRegExpQuantifier(re, start, end) and
+      re.qualifiedPart(start, part_end, end, _, may_repeat_forever)
+    }
+
+    override RegExpTerm getChild(int i) {
+      i = 0 and
+      result.getRegExp() = re and
+      result.getStart() = start and
+      result.getEnd() = part_end
+    }
+
+    /** Hodls if this term may match an unlimited number of times. */
+    predicate mayRepeatForever() { may_repeat_forever = true }
+
+    /** Gets the qualifier for this term. That is e.g "?" for "a?". */
+    string getQualifier() { result = re.getText().substring(part_end, end) }
+
+    override string getAPrimaryQlClass() { result = "RegExpQuantifier" }
+  }
+
+  /**
+   * A regular expression term that permits unlimited repetitions.
+   */
+  class InfiniteRepetitionQuantifier extends RegExpQuantifier {
+    InfiniteRepetitionQuantifier() { this.mayRepeatForever() }
+
+    override string getAPrimaryQlClass() { result = "InfiniteRepetitionQuantifier" }
+  }
+
+  /**
+   * A star-quantified term.
+   *
+   * Example:
+   *
+   * ```
+   * \w*
+   * ```
+   */
+  class RegExpStar extends InfiniteRepetitionQuantifier {
+    RegExpStar() { this.getQualifier().charAt(0) = "*" }
+
+    override string getAPrimaryQlClass() { result = "RegExpStar" }
+
+    override predicate isNullable() { any() }
+  }
+
+  /**
+   * A plus-quantified term.
+   *
+   * Example:
+   *
+   * ```
+   * \w+
+   * ```
+   */
+  class RegExpPlus extends InfiniteRepetitionQuantifier {
+    RegExpPlus() { this.getQualifier().charAt(0) = "+" }
+
+    override string getAPrimaryQlClass() { result = "RegExpPlus" }
+
+    override predicate isNullable() { this.getAChild().isNullable() }
+  }
+
+  /**
+   * An optional term.
+   *
+   * Example:
+   *
+   * ```
+   * ;?
+   * ```
+   */
+  class RegExpOpt extends RegExpQuantifier {
+    RegExpOpt() { this.getQualifier().charAt(0) = "?" }
+
+    override string getAPrimaryQlClass() { result = "RegExpOpt" }
+
+    override predicate isNullable() { any() }
+  }
+
+  /**
+   * A range-quantified term
+   *
+   * Examples:
+   *
+   * ```
+   * \w{2,4}
+   * \w{2,}
+   * \w{2}
+   * ```
+   */
+  class RegExpRange extends RegExpQuantifier {
+    string upper;
+    string lower;
+
+    RegExpRange() { re.multiples(part_end, end, lower, upper) }
+
+    override string getAPrimaryQlClass() { result = "RegExpRange" }
+
+    /** Gets the string defining the upper bound of this range, if any. */
+    string getUpper() { result = upper }
+
+    /** Gets the string defining the lower bound of this range, if any. */
+    string getLower() { result = lower }
+
+    /**
+     * Gets the upper bound of the range, if any.
+     *
+     * If there is no upper bound, any number of repetitions is allowed.
+     * For a term of the form `r{lo}`, both the lower and the upper bound
+     * are `lo`.
+     */
+    int getUpperBound() { result = this.getUpper().toInt() }
+
+    /** Gets the lower bound of the range. */
+    int getLowerBound() { result = this.getLower().toInt() }
+
+    override predicate isNullable() { this.getAChild().isNullable() or this.getLowerBound() = 0 }
+  }
+
+  /**
+   * A sequence term.
+   *
+   * Example:
+   *
+   * ```
+   * (ECMA|Java)Script
+   * ```
+   *
+   * This is a sequence with the elements `(ECMA|Java)` and `Script`.
+   */
+  class RegExpSequence extends RegExpTerm, TRegExpSequence {
+    RegExpSequence() {
+      this = TRegExpSequence(re, start, end) and
+      exists(seqChild(re, start, end, 1)) // if a sequence does not have more than one element, it should be treated as that element instead.
+    }
+
+    override RegExpTerm getChild(int i) { result = seqChild(re, start, end, i) }
+
+    /** Gets the element preceding `element` in this sequence. */
+    RegExpTerm previousElement(RegExpTerm element) { element = this.nextElement(result) }
+
+    /** Gets the element following `element` in this sequence. */
+    RegExpTerm nextElement(RegExpTerm element) {
+      exists(int i |
+        element = this.getChild(i) and
+        result = this.getChild(i + 1)
+      )
+    }
+
+    override string getConstantValue() { result = this.getConstantValue(0) }
+
+    /**
+     * Gets the single string matched by the `i`th child and all following
+     * children of this sequence, if any.
+     */
+    private string getConstantValue(int i) {
+      i = this.getNumChild() and
+      result = ""
+      or
+      result = this.getChild(i).getConstantValue() + this.getConstantValue(i + 1)
+    }
+
+    override string getAPrimaryQlClass() { result = "RegExpSequence" }
+
+    override predicate isNullable() {
+      forall(RegExpTerm child | child = this.getAChild() | child.isNullable())
+    }
+  }
+
+  pragma[nomagic]
+  private int seqChildEnd(RegExp re, int start, int end, int i) {
+    result = seqChild(re, start, end, i).getEnd()
+  }
+
+  // moved out so we can use it in the charpred
+  private RegExpTerm seqChild(RegExp re, int start, int end, int i) {
+    re.sequence(start, end) and
+    (
+      i = 0 and
+      result.getRegExp() = re and
+      result.getStart() = start and
+      exists(int itemEnd |
+        re.item(start, itemEnd) and
+        result.getEnd() = itemEnd
+      )
+      or
+      i > 0 and
+      result.getRegExp() = re and
+      exists(int itemStart | itemStart = seqChildEnd(re, start, end, i - 1) |
+        result.getStart() = itemStart and
+        re.item(itemStart, result.getEnd())
+      )
+    )
+  }
+
+  /**
+   * An alternative term, that is, a term of the form `a|b`.
+   *
+   * Example:
+   *
+   * ```
+   * ECMA|Java
+   * ```
+   */
+  class RegExpAlt extends RegExpTerm, TRegExpAlt {
+    RegExpAlt() { this = TRegExpAlt(re, start, end) }
+
+    override RegExpTerm getChild(int i) {
+      i = 0 and
+      result.getRegExp() = re and
+      result.getStart() = start and
+      exists(int part_end |
+        re.alternationOption(start, end, start, part_end) and
+        result.getEnd() = part_end
+      )
+      or
+      i > 0 and
+      result.getRegExp() = re and
+      exists(int part_start |
+        part_start = this.getChild(i - 1).getEnd() + 1 // allow for the |
+      |
+        result.getStart() = part_start and
+        re.alternationOption(start, end, part_start, result.getEnd())
+      )
+    }
+
+    /** Gets an alternative of this term. */
+    RegExpTerm getAlternative() { result = this.getAChild() }
+
+    override string getAMatchedString() { result = this.getAlternative().getAMatchedString() }
+
+    override string getAPrimaryQlClass() { result = "RegExpAlt" }
+
+    override predicate isNullable() { this.getAChild().isNullable() }
+  }
+
+  /**
+   * A character escape in a regular expression.
+   *
+   * Example:
+   *
+   * ```
+   * \.
+   * ```
+   */
+  class RegExpCharEscape = RegExpEscape;
+
+  /**
+   * An escaped regular expression term, that is, a regular expression
+   * term starting with a backslash, which is not a backreference.
+   *
+   * Example:
+   *
+   * ```
+   * \.
+   * \w
+   * ```
+   */
+  class RegExpEscape extends RegExpNormalChar {
+    RegExpEscape() { re.escapedCharacter(start, end) }
+
+    /**
+     * Gets the name of the escaped; for example, `w` for `\w`.
+     * TODO: Handle named escapes.
+     */
+    override string getValue() {
+      not this.isUnicode() and
+      not this.isHex() and
+      not this.isControl() and
+      this.isIdentityEscape() and
+      result = this.getUnescaped()
+      or
+      this.getUnescaped() = "n" and result = "\n"
+      or
+      this.getUnescaped() = "r" and result = "\r"
+      or
+      this.getUnescaped() = "t" and result = "\t"
+      or
+      this.getUnescaped() = "f" and result = 12.toUnicode()
+      or
+      this.getUnescaped() = "v" and result = 11.toUnicode()
+      or
+      this.getUnescaped() = "0" and result = 0.toUnicode()
+      or
+      this.isUnicode() and
+      result = this.getUnicode()
+      or
+      this.isHex() and
+      result = this.getHex()
+      or
+      this.isControl() and
+      result = this.getControl()
+    }
+
+    /** Holds if this terms name is given by the part following the escape character. */
+    predicate isIdentityEscape() {
+      not this.getUnescaped() in ["n", "r", "t", "f", "v", "0"] and
+      not this.isUnicode() and
+      not this.isHex() and
+      not this.isControl()
+    }
+
+    override string getAPrimaryQlClass() { result = "RegExpEscape" }
+
+    /** Gets the part of the term following the escape character. That is e.g. "w" if the term is "\w". */
+    string getUnescaped() { result = this.getText().suffix(1) }
+
+    /**
+     * Gets the text for this escape. That is e.g. "\w".
+     */
+    private string getText() { result = re.getText().substring(start, end) }
+
+    /**
+     * Holds if this is a unicode escape.
+     */
+    private predicate isUnicode() { this.getText().matches("\\u%") }
+
+    /**
+     * Gets the unicode char for this escape.
+     * E.g. for `\u0061` this returns "a".
+     */
+    private string getUnicode() {
+      this.isUnicode() and
+      result = parseHexInt(this.getText().suffix(2)).toUnicode()
+    }
+
+    /**
+     * Holds if this is a hex escape.
+     */
+    private predicate isHex() { this.getText().matches("\\x%") }
+
+    /**
+     * Gets the unicode char for this escape.
+     * E.g. for `\x61` this returns "a".
+     */
+    private string getHex() {
+      this.isHex() and
+      result = parseHexInt(this.getText().suffix(2)).toUnicode()
+    }
+
+    /**
+     * Holds if this is a `\cX` escape.
+     */
+    private predicate isControl() { this.getText().matches("\\c%") }
+
+    /**
+     * Gets the unicode char for this escape.
+     * E.g. for `\cA` this returns `0x01`.
+     */
+    private string getControl() {
+      this.isControl() and
+      exists(string letter | letter = this.getText().suffix(2).toUpperCase() |
+        result = ("ABCDEFGHIJKLMNOPQRSTUVWXYZ".indexOf(letter) + 1).toUnicode()
+      )
+    }
+  }
+
+  /**
+   * A word boundary, that is, a regular expression term of the form `\b`.
+   */
+  class RegExpWordBoundary extends RegExpSpecialChar {
+    RegExpWordBoundary() { this.getChar() = "\\b" }
+
+    override predicate isNullable() { none() }
+  }
+
+  /**
+   * A non-word boundary, that is, a regular expression term of the form `\B`.
+   */
+  class RegExpNonWordBoundary extends RegExpSpecialChar {
+    RegExpNonWordBoundary() { this.getChar() = "\\B" }
+
+    override string getAPrimaryQlClass() { result = "RegExpNonWordBoundary" }
+  }
+
+  /**
+   * A character class escape in a regular expression.
+   * That is, an escaped character that denotes multiple characters.
+   *
+   * Examples:
+   *
+   * ```
+   * \w
+   * \S
+   * ```
+   */
+  class RegExpCharacterClassEscape extends RegExpEscape {
+    RegExpCharacterClassEscape() { this.getValue() in ["d", "D", "s", "S", "w", "W"] }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpCharacterClassEscape" }
+
+    override predicate isNullable() { none() }
+  }
+
+  /**
+   * A character class in a regular expression.
+   *
+   * Examples:
+   *
+   * ```cpp
+   * "[a-fA-F0-9]"
+   * "[^abc]"
+   * ```
+   */
+  class RegExpCharacterClass extends RegExpTerm, TRegExpCharacterClass {
+    RegExpCharacterClass() { this = TRegExpCharacterClass(re, start, end) }
+
+    /** Holds if this character class is inverted, matching the opposite of its content. */
+    predicate isInverted() { re.getChar(start + 1) = "^" }
+
+    /** Holds if this character class can match anything. */
+    predicate isUniversalClass() {
+      // [^]
+      this.isInverted() and not exists(this.getAChild())
+      or
+      // [\w\W] and similar
+      not this.isInverted() and
+      exists(string cce1, string cce2 |
+        cce1 = this.getAChild().(RegExpCharacterClassEscape).getValue() and
+        cce2 = this.getAChild().(RegExpCharacterClassEscape).getValue()
+      |
+        cce1 != cce2 and cce1.toLowerCase() = cce2.toLowerCase()
+      )
+    }
+
+    override RegExpTerm getChild(int i) {
+      i = 0 and
+      result.getRegExp() = re and
+      exists(int itemStart, int itemEnd |
+        result.getStart() = itemStart and
+        re.charSetStart(start, itemStart) and
+        re.charSetChild(start, itemStart, itemEnd) and
+        result.getEnd() = itemEnd
+      )
+      or
+      i > 0 and
+      result.getRegExp() = re and
+      exists(int itemStart | itemStart = this.getChild(i - 1).getEnd() |
+        result.getStart() = itemStart and
+        re.charSetChild(start, itemStart, result.getEnd())
+      )
+    }
+
+    override string getAMatchedString() {
+      not this.isInverted() and result = this.getAChild().getAMatchedString()
+    }
+
+    override string getAPrimaryQlClass() { result = "RegExpCharacterClass" }
+
+    override predicate isNullable() { none() }
+  }
+
+  /**
+   * A character range in a character class in a regular expression.
+   *
+   * Example:
+   *
+   * ```
+   * a-z
+   * ```
+   */
+  class RegExpCharacterRange extends RegExpTerm, TRegExpCharacterRange {
+    int lower_end;
+    int upper_start;
+
+    RegExpCharacterRange() {
+      this = TRegExpCharacterRange(re, start, end) and
+      re.charRange(_, start, lower_end, upper_start, end)
+    }
+
+    /** Holds if this range goes from `lo` to `hi`, in effect is `lo-hi`. */
+    predicate isRange(string lo, string hi) {
+      lo = re.getText().substring(start, lower_end) and
+      hi = re.getText().substring(upper_start, end)
+    }
+
+    override RegExpTerm getChild(int i) {
+      i = 0 and
+      result.getRegExp() = re and
+      result.getStart() = start and
+      result.getEnd() = lower_end
+      or
+      i = 1 and
+      result.getRegExp() = re and
+      result.getStart() = upper_start and
+      result.getEnd() = end
+    }
+
+    override string getAPrimaryQlClass() { result = "RegExpCharacterRange" }
+
+    override predicate isNullable() { none() }
+  }
+
+  /**
+   * A normal character in a regular expression, that is, a character
+   * without special meaning. This includes escaped characters.
+   *
+   * Examples:
+   * ```
+   * t
+   * \t
+   * ```
+   */
+  additional class RegExpNormalChar extends RegExpTerm, TRegExpNormalChar {
+    RegExpNormalChar() { this = TRegExpNormalChar(re, start, end) }
+
+    /**
+     * Holds if this constant represents a valid Unicode character (as opposed
+     * to a surrogate code point that does not correspond to a character by itself.)
+     */
+    predicate isCharacter() { any() }
+
+    /** Gets the string representation of the char matched by this term. */
+    string getValue() { result = re.getText().substring(start, end) }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpNormalChar" }
+  }
+
+  /**
+   * A constant regular expression term, that is, a regular expression
+   * term matching a single string. Currently, this will always be a single character.
+   *
+   * Example:
+   *
+   * ```
+   * a
+   * ```
+   */
+  class RegExpConstant extends RegExpTerm {
+    string value;
+
+    RegExpConstant() {
+      this = TRegExpNormalChar(re, start, end) and
+      not this instanceof RegExpCharacterClassEscape and
+      // exclude chars in qualifiers
+      // TODO: push this into regex library
+      not exists(int qstart, int qend | re.qualifiedPart(_, qstart, qend, _, _) |
+        qstart <= start and end <= qend
+      ) and
+      value = this.(RegExpNormalChar).getValue()
+      or
+      this = TRegExpSpecialChar(re, start, end) and
+      re.inCharSet(start) and
+      value = this.(RegExpSpecialChar).getChar()
+    }
+
+    /**
+     * Holds if this constant represents a valid Unicode character (as opposed
+     * to a surrogate code point that does not correspond to a character by itself.)
+     */
+    predicate isCharacter() { any() }
+
+    /** Gets the string matched by this constant term. */
+    string getValue() { result = value }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getConstantValue() { result = this.getValue() }
+
+    override string getAPrimaryQlClass() { result = "RegExpConstant" }
+
+    override predicate isNullable() { none() }
+  }
+
+  /**
+   * A grouped regular expression.
+   *
+   * Examples:
+   *
+   * ```
+   * (ECMA|Java)
+   * (?:ECMA|Java)
+   * (?<quote>['"])
+   * ```
+   */
+  class RegExpGroup extends RegExpTerm, TRegExpGroup {
+    RegExpGroup() { this = TRegExpGroup(re, start, end) }
+
+    /**
+     * Gets the index of this capture group within the enclosing regular
+     * expression literal.
+     *
+     * For example, in the regular expression `/((a?).)(?:b)/`, the
+     * group `((a?).)` has index 1, the group `(a?)` nested inside it
+     * has index 2, and the group `(?:b)` has no index, since it is
+     * not a capture group.
+     */
+    int getNumber() { result = re.getGroupNumber(start, end) }
+
+    /** Holds if this is a capture group. */
+    predicate isCapture() { exists(this.getNumber()) }
+
+    override RegExpTerm getChild(int i) {
+      result.getRegExp() = re and
+      i = 0 and
+      re.groupContents(start, end, result.getStart(), result.getEnd())
+    }
+
+    override string getConstantValue() { result = this.getAChild().getConstantValue() }
+
+    override string getAMatchedString() { result = this.getAChild().getAMatchedString() }
+
+    override string getAPrimaryQlClass() { result = "RegExpGroup" }
+
+    override predicate isNullable() { this.getAChild().isNullable() }
+  }
+
+  /**
+   * A special character in a regular expression.
+   *
+   * Examples:
+   * ```
+   * ^
+   * $
+   * .
+   * ```
+   */
+  additional class RegExpSpecialChar extends RegExpTerm, TRegExpSpecialChar {
+    string char;
+
+    RegExpSpecialChar() {
+      this = TRegExpSpecialChar(re, start, end) and
+      re.specialCharacter(start, end, char)
+    }
+
+    /**
+     * Holds if this constant represents a valid Unicode character (as opposed
+     * to a surrogate code point that does not correspond to a character by itself.)
+     */
+    predicate isCharacter() { any() }
+
+    /** Gets the char for this term. */
+    string getChar() { result = char }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpSpecialChar" }
+  }
+
+  /**
+   * A dot regular expression.
+   *
+   * Example:
+   *
+   * ```
+   * .
+   * ```
+   */
+  class RegExpDot extends RegExpSpecialChar {
+    RegExpDot() { this.getChar() = "." }
+
+    override string getAPrimaryQlClass() { result = "RegExpDot" }
+
+    override predicate isNullable() { none() }
+  }
+
+  /**
+   * A term that matches a specific position between characters in the string.
+   *
+   * Example:
+   *
+   * ```
+   * ^
+   * ```
+   */
+  class RegExpAnchor extends RegExpSpecialChar {
+    RegExpAnchor() { this.getChar() = ["^", "$"] }
+
+    override string getAPrimaryQlClass() { result = "RegExpAnchor" }
+  }
+
+  /**
+   * A dollar assertion `$` matching the end of a line.
+   *
+   * Example:
+   *
+   * ```
+   * $
+   * ```
+   */
+  class RegExpDollar extends RegExpAnchor {
+    RegExpDollar() { this.getChar() = "$" }
+
+    override string getAPrimaryQlClass() { result = "RegExpDollar" }
+
+    override predicate isNullable() { any() }
+  }
+
+  /**
+   * A caret assertion `^` matching the beginning of a line.
+   *
+   * Example:
+   *
+   * ```
+   * ^
+   * ```
+   */
+  class RegExpCaret extends RegExpAnchor {
+    RegExpCaret() { this.getChar() = "^" }
+
+    override string getAPrimaryQlClass() { result = "RegExpCaret" }
+
+    override predicate isNullable() { any() }
+  }
+
+  /**
+   * A zero-width match, that is, either an empty group or an assertion.
+   *
+   * Examples:
+   * ```
+   * ()
+   * (?=\w)
+   * ```
+   */
+  additional class RegExpZeroWidthMatch extends RegExpGroup {
+    RegExpZeroWidthMatch() { re.zeroWidthMatch(start, end) }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpZeroWidthMatch" }
+
+    override predicate isNullable() { any() }
+  }
+
+  /**
+   * A zero-width lookahead assertion.
+   *
+   * Examples:
+   *
+   * ```
+   * (?=\w)
+   * (?!\n)
+   * ```
+   */
+  class RegExpSubPattern extends RegExpZeroWidthMatch {
+    RegExpSubPattern() { not re.emptyGroup(start, end) }
+
+    /** Gets the lookahead term. */
+    RegExpTerm getOperand() {
+      exists(int in_start, int in_end | re.groupContents(start, end, in_start, in_end) |
+        result.getRegExp() = re and
+        result.getStart() = in_start and
+        result.getEnd() = in_end
+      )
+    }
+
+    override predicate isNullable() { any() }
+  }
+
+  /**
+   * A zero-width lookahead assertion.
+   *
+   * Examples:
+   *
+   * ```
+   * (?=\w)
+   * (?!\n)
+   * ```
+   */
+  abstract class RegExpLookahead extends RegExpSubPattern { }
+
+  /**
+   * A positive-lookahead assertion.
+   *
+   * Examples:
+   *
+   * ```
+   * (?=\w)
+   * ```
+   */
+  class RegExpPositiveLookahead extends RegExpLookahead {
+    RegExpPositiveLookahead() { re.positiveLookaheadAssertionGroup(start, end) }
+
+    override string getAPrimaryQlClass() { result = "RegExpPositiveLookahead" }
+
+    override predicate isNullable() { any() }
+  }
+
+  /**
+   * A negative-lookahead assertion.
+   *
+   * Examples:
+   *
+   * ```
+   * (?!\n)
+   * ```
+   */
+  additional class RegExpNegativeLookahead extends RegExpLookahead {
+    RegExpNegativeLookahead() { re.negativeLookaheadAssertionGroup(start, end) }
+
+    override string getAPrimaryQlClass() { result = "RegExpNegativeLookahead" }
+  }
+
+  abstract class RegExpLookbehind extends RegExpSubPattern { }
+
+  abstract class RegExpPositiveLookbehind extends RegExpLookbehind { }
+
+  /**
+   * A back reference, that is, a term of the form `\i` in a regular
+   * expression.
+   *
+   * Examples:
+   *
+   * ```
+   * \1
+   * ```
+   */
+  class RegExpBackRef extends RegExpTerm, TRegExpBackRef {
+    RegExpBackRef() { this = TRegExpBackRef(re, start, end) }
+
+    /**
+     * Gets the number of the capture group this back reference refers to, if any.
+     */
+    int getNumber() { result = re.getBackRefNumber(start, end) }
+
+    /** Gets the capture group this back reference refers to. */
+    RegExpGroup getGroup() {
+      result.getLiteral() = this.getLiteral() and
+      result.getNumber() = this.getNumber()
+    }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpBackRef" }
+
+    override predicate isNullable() { this.getGroup().isNullable() }
+  }
+
+  /**
+   * A named character property. For example, the POSIX bracket expression
+   * `[:digit:]`.
+   */
+  additional class RegExpNamedCharacterProperty extends RegExpTerm, TRegExpNamedCharacterProperty {
+    RegExpNamedCharacterProperty() { this = TRegExpNamedCharacterProperty(re, start, end) }
+
+    override RegExpTerm getChild(int i) { none() }
+
+    override string getAPrimaryQlClass() { result = "RegExpNamedCharacterProperty" }
+
+    /**
+     * Gets the property name. For example, in `[:digit:]`, the result is
+     * `"digit"`.
+     */
+    string getName() { result = re.getCharacterPropertyName(start, end) }
+
+    /**
+     * Gets the property symbol. For example, in `[:digit:]`, the result is
+     * `":"`.
+     */
+    string getSymbol() { result = re.getCharacterPropertySymbol(start, end) }
+  }
+
+  class Top = RegExpParent;
+
+  /**
+   * Holds if `term` is an escape class representing e.g. `\d`.
+   * `clazz` is which character class it represents, e.g. "d" for `\d`.
+   */
+  predicate isEscapeClass(RegExpTerm term, string clazz) {
+    exists(RegExpCharacterClassEscape escape | term = escape | escape.getValue() = clazz)
+    or
+    // TODO: expand to cover more properties
+    exists(RegExpNamedCharacterProperty escape | term = escape |
+      escape.getName().toLowerCase() = "digit" and
+      clazz = "d"
+      or
+      escape.getName().toLowerCase() = "space" and
+      clazz = "s"
+      or
+      escape.getName().toLowerCase() = "word" and
+      clazz = "w"
+    )
+  }
+
+  /**
+   * Holds if the regular expression should not be considered.
+   */
+  predicate isExcluded(RegExpParent parent) { none() }
+
+  /**
+   * Holds if `term` is a possessive quantifier.
+   * Not currently implemented, but is used by the shared library.
+   */
+  predicate isPossessive(RegExpQuantifier term) { none() }
+
+  /**
+   * Holds if the regex that `term` is part of is used in a way that ignores any leading prefix of the input it's matched against.
+   * Not yet implemented for C++.
+   */
+  predicate matchesAnyPrefix(RegExpTerm term) { any() }
+
+  /**
+   * Holds if the regex that `term` is part of is used in a way that ignores any trailing suffix of the input it's matched against.
+   * Not yet implemented for C++.
+   */
+  predicate matchesAnySuffix(RegExpTerm term) { any() }
+
+  /**
+   * Holds if `root` has the `i` flag for case-insensitive matching.
+   */
+  predicate isIgnoreCase(RegExpTerm root) {
+    root.isRootTerm() and
+    root.getLiteral().isIgnoreCase()
+  }
+
+  /**
+   * Holds if `root` has the `s` flag for multi-line matching.
+   */
+  predicate isDotAll(RegExpTerm root) {
+    root.isRootTerm() and
+    root.getLiteral().isDotAll()
+  }
+}
diff --git a/cpp/ql/lib/semmle/code/cpp/regex/internal/ParseRegExp.qll b/cpp/ql/lib/semmle/code/cpp/regex/internal/ParseRegExp.qll
new file mode 100644
index 000000000000..2184c5f1b45a
--- /dev/null
+++ b/cpp/ql/lib/semmle/code/cpp/regex/internal/ParseRegExp.qll
@@ -0,0 +1,871 @@
+/**
+ * Library for parsing for C++ regular expressions.
+ *
+ * N.B. does not yet handle stripping whitespace and comments in regexes with
+ * the `x` (free-spacing) flag.
+ */
+
+private import semmle.code.cpp.exprs.Literal
+
+/**
+ * A C++ string literal containing a regular expression term, that is, either
+ * a regular expression literal, or a string literal used in a context where
+ * it is parsed as a regular expression.
+ */
+abstract class RegExp extends StringLiteral {
+  /**
+   * Holds if this `RegExp` has the `s` flag for multi-line matching.
+   */
+  predicate isDotAll() { none() }
+
+  /**
+   * Holds if this `RegExp` has the `i` flag for case-insensitive matching.
+   */
+  predicate isIgnoreCase() { none() }
+
+  /**
+   * Gets the flags for this `RegExp`, or the empty string if it has no flags.
+   */
+  string getFlags() { result = "" }
+
+  /**
+   * Helper predicate for `charSetStart(int start, int end)`.
+   *
+   * In order to identify left brackets ('[') which actually start a character class,
+   * we perform a left to right scan of the string.
+   *
+   * To avoid negative recursion we return a boolean. See `escaping`,
+   * the helper for `escapingChar`, for a clean use of this pattern.
+   *
+   * result is true for those start chars that actually mark a start of a char set.
+   */
+  boolean charSetStart(int pos) {
+    exists(int index |
+      // is opening bracket
+      this.charSetDelimiter(index, pos) = true and
+      (
+        // if this is the first bracket, `pos` starts a char set
+        index = 1 and result = true
+        or
+        // if the previous char set delimiter was not a closing bracket, `pos` does
+        // not start a char set. This is needed to handle cases such as `[[]` (a
+        // char set that matches the `[` char)
+        index > 1 and
+        not this.charSetDelimiter(index - 1, _) = false and
+        result = false
+        or
+        // special handling of cases such as `[][]` (the character-set of the characters `]` and `[`).
+        exists(int prevClosingBracketPos |
+          // previous bracket is a closing bracket
+          this.charSetDelimiter(index - 1, prevClosingBracketPos) = false and
+          if
+            // check if the character that comes before the previous closing bracket
+            // is an opening bracket (taking `^` into account)
+            // check if the character that comes before the previous closing bracket
+            // is an opening bracket (taking `^` into account)
+            exists(int posBeforePrevClosingBracket |
+              if this.getChar(prevClosingBracketPos - 1) = "^"
+              then posBeforePrevClosingBracket = prevClosingBracketPos - 2
+              else posBeforePrevClosingBracket = prevClosingBracketPos - 1
+            |
+              this.charSetDelimiter(index - 2, posBeforePrevClosingBracket) = true
+            )
+          then
+            // brackets without anything in between is not valid character ranges, so
+            // the first closing bracket in `[]]` and `[^]]` does not count,
+            //
+            // and we should _not_ mark the second opening bracket in `[][]` and `[^][]`
+            // as starting a new char set.                               ^           ^
+            exists(int posBeforePrevClosingBracket |
+              this.charSetDelimiter(index - 2, posBeforePrevClosingBracket) = true
+            |
+              result = this.charSetStart(posBeforePrevClosingBracket).booleanNot()
+            )
+          else
+            // if not, `pos` does in fact mark a real start of a character range
+            result = true
+        )
+      )
+    )
+  }
+
+  /**
+   * Helper predicate for chars that could be character-set delimiters.
+   * Holds if the (non-escaped) char at `pos` in the string, is the (one-based) `index` occurrence of a bracket (`[` or `]`) in the string.
+   * Result if `true` is the char is `[`, and `false` if the char is `]`.
+   */
+  boolean charSetDelimiter(int index, int pos) {
+    pos =
+      rank[index](int p |
+        (this.nonEscapedCharAt(p) = "[" or this.nonEscapedCharAt(p) = "]") and
+        // Brackets that are part of POSIX expressions should not count as
+        // char-set delimiters.
+        not exists(int x, int y | this.posixStyleProperty(x, y, _, _) and pos >= x and pos < y)
+      ) and
+    (
+      this.nonEscapedCharAt(pos) = "[" and result = true
+      or
+      this.nonEscapedCharAt(pos) = "]" and result = false
+    )
+  }
+
+  /** Holds if a character set starts between `start` and `end`. */
+  predicate charSetStart(int start, int end) {
+    this.charSetStart(start) = true and
+    (
+      this.getChar(start + 1) = "^" and end = start + 2
+      or
+      not this.getChar(start + 1) = "^" and end = start + 1
+    )
+  }
+
+  /** Whether there is a character class, between start (inclusive) and end (exclusive) */
+  predicate charSet(int start, int end) {
+    exists(int innerStart, int innerEnd |
+      this.charSetStart(start, innerStart) and
+      not this.charSetStart(_, start)
+    |
+      end = innerEnd + 1 and
+      innerEnd =
+        min(int e |
+          e > innerStart and
+          this.nonEscapedCharAt(e) = "]" and
+          not exists(int x, int y | this.posixStyleProperty(x, y, _, _) and e >= x and e < y)
+        |
+          e
+        )
+    )
+  }
+
+  /**
+   * Holds if the character set starting at `charsetStart` contains either
+   * a character or a `-` found between `start` and `end`.
+   */
+  private predicate charSetToken(int charsetStart, int index, int tokenStart, int tokenEnd) {
+    tokenStart =
+      rank[index](int start, int end | this.charSetToken(charsetStart, start, end) | start) and
+    this.charSetToken(charsetStart, tokenStart, tokenEnd)
+  }
+
+  /**
+   * Holds if the character set starting at `charsetStart` contains either
+   * a character or a `-` found between `start` and `end`.
+   */
+  private predicate charSetToken(int charsetStart, int start, int end) {
+    this.charSetStart(charsetStart, start) and
+    (
+      this.escapedCharacter(start, end)
+      or
+      this.namedCharacterProperty(start, end, _, _)
+      or
+      exists(this.nonEscapedCharAt(start)) and end = start + 1
+    )
+    or
+    this.charSetToken(charsetStart, _, start) and
+    (
+      this.escapedCharacter(start, end)
+      or
+      this.namedCharacterProperty(start, end, _, _)
+      or
+      exists(this.nonEscapedCharAt(start)) and
+      end = start + 1 and
+      not this.getChar(start) = "]"
+    )
+  }
+
+  /**
+   * Holds if the character set starting at `charsetStart` contains either
+   * a character or a range found between `start` and `end`.
+   */
+  predicate charSetChild(int charsetStart, int start, int end) {
+    this.charSetToken(charsetStart, start, end) and
+    not exists(int rangeStart, int rangeEnd |
+      this.charRange(charsetStart, rangeStart, _, _, rangeEnd) and
+      rangeStart <= start and
+      rangeEnd >= end
+    )
+    or
+    this.charRange(charsetStart, start, _, _, end)
+  }
+
+  /**
+   * Holds if the character set starting at `charsetStart` contains a character range
+   * with lower bound found between `start` and `lowerEnd`
+   * and upper bound found between `upperStart` and `end`.
+   */
+  predicate charRange(int charsetStart, int start, int lowerEnd, int upperStart, int end) {
+    exists(int index |
+      this.charRangeEnd(charsetStart, index) = true and
+      this.charSetToken(charsetStart, index - 2, start, lowerEnd) and
+      this.charSetToken(charsetStart, index, upperStart, end)
+    )
+  }
+
+  /**
+   * Helper predicate for `charRange`.
+   * We can determine where character ranges end by a left to right sweep.
+   *
+   * To avoid negative recursion we return a boolean. See `escaping`,
+   * the helper for `escapingChar`, for a clean use of this pattern.
+   */
+  private boolean charRangeEnd(int charsetStart, int index) {
+    this.charSetToken(charsetStart, index, _, _) and
+    (
+      index in [1, 2] and result = false
+      or
+      index > 2 and
+      exists(int connectorStart |
+        this.charSetToken(charsetStart, index - 1, connectorStart, _) and
+        this.nonEscapedCharAt(connectorStart) = "-" and
+        result =
+          this.charRangeEnd(charsetStart, index - 2)
+              .booleanNot()
+              .booleanAnd(this.charRangeEnd(charsetStart, index - 1).booleanNot())
+      )
+      or
+      not exists(int connectorStart |
+        this.charSetToken(charsetStart, index - 1, connectorStart, _) and
+        this.nonEscapedCharAt(connectorStart) = "-"
+      ) and
+      result = false
+    )
+  }
+
+  /** Holds if the character at `pos` is a "\" that is actually escaping what comes after. */
+  predicate escapingChar(int pos) { this.escaping(pos) = true }
+
+  /**
+   * Helper predicate for `escapingChar`.
+   * In order to avoid negative recursion, we return a boolean.
+   * This way, we can refer to `escaping(pos - 1).booleanNot()`
+   * rather than to a negated version of `escaping(pos)`.
+   */
+  private boolean escaping(int pos) {
+    pos = -1 and result = false
+    or
+    this.getChar(pos) = "\\" and result = this.escaping(pos - 1).booleanNot()
+    or
+    this.getChar(pos) != "\\" and result = false
+  }
+
+  /** Gets the text of this regex */
+  string getText() { result = this.getValue() }
+
+  /** Gets the `i`th character of this regex */
+  string getChar(int i) { result = this.getText().charAt(i) }
+
+  /** Gets the `i`th character of this regex, unless it is part of a character escape sequence. */
+  string nonEscapedCharAt(int i) {
+    result = this.getText().charAt(i) and
+    not exists(int x, int y | this.escapedCharacter(x, y) and i in [x .. y - 1])
+  }
+
+  private predicate isOptionDivider(int i) { this.nonEscapedCharAt(i) = "|" }
+
+  private predicate isGroupEnd(int i) { this.nonEscapedCharAt(i) = ")" and not this.inCharSet(i) }
+
+  private predicate isGroupStart(int i) { this.nonEscapedCharAt(i) = "(" and not this.inCharSet(i) }
+
+  /**
+   * Holds if the `i`th character could not be parsed.
+   */
+  predicate failedToParse(int i) {
+    exists(this.getChar(i)) and
+    not exists(int start, int end |
+      this.topLevel(start, end) and
+      start <= i and
+      end > i
+    )
+  }
+
+  /** Matches named character properties such as `[:digit:]`. */
+  predicate namedCharacterProperty(int start, int end, string symbol, string name) {
+    this.posixStyleProperty(start, end, symbol, name)
+  }
+
+  /** Gets the name of the character property in start,end */
+  string getCharacterPropertyName(int start, int end) {
+    this.namedCharacterProperty(start, end, _, result)
+  }
+
+  /** Gets the symbol of the character property in start,end */
+  string getCharacterPropertySymbol(int start, int end) {
+    this.namedCharacterProperty(start, end, result, _)
+  }
+
+  /** Matches a POSIX bracket expression such as `[:alnum:]` within a character class. */
+  private predicate posixStyleProperty(int start, int end, string symbol, string name) {
+    this.getChar(start) = "[" and
+    this.getChar(start + 1) = symbol and
+    end =
+      min(int e |
+        e > start and
+        this.getChar(e - 2) = symbol and
+        this.getChar(e - 1) = "]"
+      |
+        e
+      ) and
+    symbol in [":", ".", "="] and
+    name = this.getText().substring(start + 2, end - 2)
+  }
+
+  /**
+   * Holds if an escaped character is found between `start` and `end`.
+   * Escaped characters include hex values, octal values and named escapes,
+   * but excludes backreferences.
+   */
+  predicate escapedCharacter(int start, int end) {
+    this.escapingChar(start) and
+    not this.numberedBackreference(start, _, _) and
+    (
+      // hex char \xhh
+      this.getChar(start + 1) = "x" and end = start + 4
+      or
+      // wide hex char \uhhhh
+      this.getChar(start + 1) = "u" and end = start + 6
+      or
+      // control char \cX
+      this.getChar(start + 1) = "c" and end = start + 3
+      or
+      // nul escape \0 (when not followed by a digit)
+      this.getChar(start + 1) = "0" and
+      end = start + 2 and
+      not exists(this.getChar(start + 2).toInt())
+      or
+      // escape not handled above; update when adding a new case
+      not this.getChar(start + 1) in ["x", "u", "c"] and
+      not exists(this.getChar(start + 1).toInt()) and
+      end = start + 2
+    )
+  }
+
+  /**
+   * Holds if the character at `index` is inside a character set.
+   */
+  predicate inCharSet(int index) {
+    exists(int x, int y | this.charSet(x, y) and index in [x + 1 .. y - 2])
+  }
+
+  /**
+   * Holds if the character at `index` is inside a posix bracket.
+   */
+  predicate inPosixBracket(int index) {
+    exists(int x, int y | this.posixStyleProperty(x, y, _, _) and index in [x + 1 .. y - 2])
+  }
+
+  /**
+   * 'simple' characters are any that don't alter the parsing of the regex.
+   */
+  private predicate simpleCharacter(int start, int end) {
+    end = start + 1 and
+    not this.charSet(start, _) and
+    not this.charSet(_, start + 1) and
+    not exists(int x, int y |
+      this.posixStyleProperty(x, y, _, _) and
+      start >= x and
+      end <= y
+    ) and
+    exists(string c | c = this.getChar(start) |
+      exists(int x, int y, int z |
+        this.charSet(x, z) and
+        this.charSetStart(x, y)
+      |
+        start = y
+        or
+        start = z - 2
+        or
+        start > y and start < z - 2 and not this.charRange(_, _, start, end, _)
+      )
+      or
+      not this.inCharSet(start) and
+      not c = "(" and
+      not c = "[" and
+      not c = ")" and
+      not c = "|" and
+      not this.qualifier(start, _, _, _)
+    )
+  }
+
+  /**
+   * Holds if a simple or escaped character is found between `start` and `end`.
+   */
+  predicate character(int start, int end) {
+    (
+      this.simpleCharacter(start, end) and
+      not exists(int x, int y | this.escapedCharacter(x, y) and x <= start and y >= end)
+      or
+      this.escapedCharacter(start, end)
+    ) and
+    not exists(int x, int y | this.groupStart(x, y) and x <= start and y >= end) and
+    not exists(int x, int y | this.backreference(x, y) and x <= start and y >= end) and
+    not exists(int x, int y | this.multiples(x, y, _, _) and x <= start and y >= end)
+  }
+
+  /**
+   * Holds if a normal character is found between `start` and `end`.
+   */
+  predicate normalCharacter(int start, int end) {
+    end = start + 1 and
+    this.character(start, end) and
+    not this.specialCharacter(start, end, _)
+  }
+
+  /**
+   * Holds if a special character is found between `start` and `end`.
+   */
+  predicate specialCharacter(int start, int end, string char) {
+    this.character(start, end) and
+    not this.inCharSet(start) and
+    (
+      end = start + 1 and
+      char = this.getChar(start) and
+      (char = "$" or char = "^" or char = ".")
+      or
+      end = start + 2 and
+      this.escapingChar(start) and
+      char = this.getText().substring(start, end) and
+      char = ["\\b", "\\B"]
+    )
+  }
+
+  /**
+   * Holds if the range [start:end) consists of only 'normal' characters.
+   */
+  predicate normalCharacterSequence(int start, int end) {
+    // a normal character inside a character set is interpreted on its own
+    this.normalCharacter(start, end) and
+    this.inCharSet(start)
+    or
+    // a maximal run of normal characters is considered as one constant
+    exists(int s, int e |
+      e = max(int i | this.normalCharacterRun(s, i)) and
+      not this.inCharSet(s)
+    |
+      // 'abc' can be considered one constant, but
+      // 'abc+' has to be broken up into 'ab' and 'c+',
+      // as the qualifier only applies to 'c'.
+      if this.qualifier(e, _, _, _)
+      then
+        end = e and start = e - 1
+        or
+        end = e - 1 and start = s and start < end
+      else (
+        end = e and
+        start = s
+      )
+    )
+  }
+
+  private predicate normalCharacterRun(int start, int end) {
+    (
+      this.normalCharacterRun(start, end - 1)
+      or
+      start = end - 1 and not this.normalCharacter(start - 1, start)
+    ) and
+    this.normalCharacter(end - 1, end)
+  }
+
+  private predicate characterItem(int start, int end) {
+    this.normalCharacterSequence(start, end) or
+    this.escapedCharacter(start, end) or
+    this.specialCharacter(start, end, _)
+  }
+
+  /** Whether the text in the range `start,end` is a group */
+  predicate group(int start, int end) {
+    this.groupContents(start, end, _, _)
+    or
+    this.emptyGroup(start, end)
+  }
+
+  /** Gets the number of the group in start,end */
+  int getGroupNumber(int start, int end) {
+    this.group(start, end) and
+    not this.nonCapturingGroupStart(start, _) and
+    result =
+      count(int i | this.group(i, _) and i < start and not this.nonCapturingGroupStart(i, _)) + 1
+  }
+
+  /** Whether the text in the range start, end is a group and can match the empty string. */
+  predicate zeroWidthMatch(int start, int end) {
+    this.emptyGroup(start, end)
+    or
+    this.negativeAssertionGroup(start, end)
+    or
+    this.positiveLookaheadAssertionGroup(start, end)
+  }
+
+  /** Holds if an empty group is found between `start` and `end`. */
+  predicate emptyGroup(int start, int end) {
+    exists(int endm1 | end = endm1 + 1 |
+      this.groupStart(start, endm1) and
+      this.isGroupEnd(endm1)
+    )
+  }
+
+  private predicate emptyMatchAtStartGroup(int start, int end) {
+    this.emptyGroup(start, end)
+    or
+    this.negativeAssertionGroup(start, end)
+    or
+    this.positiveLookaheadAssertionGroup(start, end)
+  }
+
+  private predicate emptyMatchAtEndGroup(int start, int end) {
+    this.emptyGroup(start, end)
+    or
+    this.negativeAssertionGroup(start, end)
+  }
+
+  private predicate negativeAssertionGroup(int start, int end) {
+    exists(int inStart | this.negativeLookaheadAssertionStart(start, inStart) |
+      this.groupContents(start, end, inStart, _)
+    )
+  }
+
+  /** Holds if a negative lookahead is found between `start` and `end` */
+  predicate negativeLookaheadAssertionGroup(int start, int end) {
+    exists(int inStart | this.negativeLookaheadAssertionStart(start, inStart) |
+      this.groupContents(start, end, inStart, _)
+    )
+  }
+
+  /** Holds if a positive lookahead is found between `start` and `end` */
+  predicate positiveLookaheadAssertionGroup(int start, int end) {
+    exists(int inStart | this.lookaheadAssertionStart(start, inStart) |
+      this.groupContents(start, end, inStart, _)
+    )
+  }
+
+  private predicate groupStart(int start, int end) {
+    this.nonCapturingGroupStart(start, end)
+    or
+    this.lookaheadAssertionStart(start, end)
+    or
+    this.negativeLookaheadAssertionStart(start, end)
+    or
+    this.simpleGroupStart(start, end)
+  }
+
+  /** Matches the start of a non-capturing group, e.g. `(?:` */
+  private predicate nonCapturingGroupStart(int start, int end) {
+    this.isGroupStart(start) and
+    this.getChar(start + 1) = "?" and
+    this.getChar(start + 2) = [":", "=", "!"] and
+    end = start + 3
+  }
+
+  /** Matches the start of a simple group, e.g. `(a+)`. */
+  private predicate simpleGroupStart(int start, int end) {
+    this.isGroupStart(start) and
+    this.getChar(start + 1) != "?" and
+    end = start + 1
+  }
+
+  /** Matches the start of a positive lookahead assertion, i.e. `(?=`. */
+  private predicate lookaheadAssertionStart(int start, int end) {
+    this.isGroupStart(start) and
+    this.getChar(start + 1) = "?" and
+    this.getChar(start + 2) = "=" and
+    end = start + 3
+  }
+
+  /** Matches the start of a negative lookahead assertion, i.e. `(?!`. */
+  private predicate negativeLookaheadAssertionStart(int start, int end) {
+    this.isGroupStart(start) and
+    this.getChar(start + 1) = "?" and
+    this.getChar(start + 2) = "!" and
+    end = start + 3
+  }
+
+  /** Matches the contents of a group. */
+  predicate groupContents(int start, int end, int inStart, int inEnd) {
+    this.groupStart(start, inStart) and
+    end = inEnd + 1 and
+    this.topLevel(inStart, inEnd) and
+    this.isGroupEnd(inEnd)
+  }
+
+  /** Matches a numbered backreference, e.g. `\1`. */
+  predicate numberedBackreference(int start, int end, int value) {
+    this.escapingChar(start) and
+    not this.getChar(start + 1) = "0" and
+    exists(string text, string svalue, int len |
+      end = start + len and
+      text = this.getText() and
+      len in [2 .. 3]
+    |
+      svalue = text.substring(start + 1, start + len) and
+      value = svalue.toInt() and
+      not exists(text.substring(start + 1, start + len + 1).toInt()) and
+      value > 0
+    )
+  }
+
+  /** Whether the text in the range `start,end` is a back reference */
+  predicate backreference(int start, int end) { this.numberedBackreference(start, end, _) }
+
+  /** Gets the number of the back reference in start,end */
+  int getBackRefNumber(int start, int end) { this.numberedBackreference(start, end, result) }
+
+  private predicate baseItem(int start, int end) {
+    this.characterItem(start, end) and
+    not exists(int x, int y | this.charSet(x, y) and x <= start and y >= end)
+    or
+    this.group(start, end)
+    or
+    this.charSet(start, end)
+    or
+    this.backreference(start, end)
+  }
+
+  private predicate qualifier(int start, int end, boolean maybeEmpty, boolean mayRepeatForever) {
+    this.shortQualifier(start, end, maybeEmpty, mayRepeatForever) and
+    not this.getChar(end) = "?"
+    or
+    exists(int shortEnd | this.shortQualifier(start, shortEnd, maybeEmpty, mayRepeatForever) |
+      if this.getChar(shortEnd) = "?" then end = shortEnd + 1 else end = shortEnd
+    )
+  }
+
+  private predicate shortQualifier(int start, int end, boolean maybeEmpty, boolean mayRepeatForever) {
+    (
+      this.getChar(start) = "+" and maybeEmpty = false and mayRepeatForever = true
+      or
+      this.getChar(start) = "*" and maybeEmpty = true and mayRepeatForever = true
+      or
+      this.getChar(start) = "?" and maybeEmpty = true and mayRepeatForever = false
+    ) and
+    end = start + 1
+    or
+    exists(string lower, string upper |
+      this.multiples(start, end, lower, upper) and
+      (if lower = "" or lower.toInt() = 0 then maybeEmpty = true else maybeEmpty = false) and
+      if upper = "" then mayRepeatForever = true else mayRepeatForever = false
+    )
+  }
+
+  /**
+   * Holds if a repetition quantifier is found between `start` and `end`,
+   * with the given lower and upper bounds. If a bound is omitted, the corresponding
+   * string is empty.
+   */
+  predicate multiples(int start, int end, string lower, string upper) {
+    exists(string text, string match, string inner |
+      text = this.getText() and
+      end = start + match.length() and
+      inner = match.substring(1, match.length() - 1)
+    |
+      match = text.regexpFind("\\{[0-9]+\\}", _, start) and
+      lower = inner and
+      upper = lower
+      or
+      match = text.regexpFind("\\{[0-9]+,[0-9]*\\}", _, start) and
+      exists(int commaIndex |
+        commaIndex = inner.indexOf(",") and
+        lower = inner.prefix(commaIndex) and
+        upper = inner.suffix(commaIndex + 1)
+      )
+    )
+  }
+
+  /**
+   * Whether the text in the range start,end is a qualified item, where item is a character,
+   * a character set or a group.
+   */
+  predicate qualifiedItem(int start, int end, boolean maybeEmpty, boolean mayRepeatForever) {
+    this.qualifiedPart(start, _, end, maybeEmpty, mayRepeatForever)
+  }
+
+  /**
+   * Holds if a qualified part is found between `start` and `partEnd` and the qualifier is
+   * found between `partEnd` and `end`.
+   *
+   * `maybeEmpty` is true if the part is optional.
+   * `mayRepeatForever` is true if the part may be repeated unboundedly.
+   */
+  predicate qualifiedPart(
+    int start, int partEnd, int end, boolean maybeEmpty, boolean mayRepeatForever
+  ) {
+    this.baseItem(start, partEnd) and
+    this.qualifier(partEnd, end, maybeEmpty, mayRepeatForever)
+  }
+
+  /** Holds if the range `start`, `end` contains a character, a quantifier, a character set or a group. */
+  predicate item(int start, int end) {
+    this.qualifiedItem(start, end, _, _)
+    or
+    this.baseItem(start, end) and not this.qualifier(end, _, _, _)
+  }
+
+  private predicate subsequence(int start, int end) {
+    (
+      start = 0 or
+      this.groupStart(_, start) or
+      this.isOptionDivider(start - 1)
+    ) and
+    this.item(start, end)
+    or
+    exists(int mid |
+      this.subsequence(start, mid) and
+      this.item(mid, end)
+    )
+  }
+
+  /**
+   * Whether the text in the range start,end is a sequence of 1 or more items, where an item is a character,
+   * a character set or a group.
+   */
+  predicate sequence(int start, int end) {
+    this.sequenceOrQualified(start, end) and
+    not this.qualifiedItem(start, end, _, _)
+  }
+
+  private predicate sequenceOrQualified(int start, int end) {
+    this.subsequence(start, end) and
+    not this.itemStart(end)
+  }
+
+  private predicate itemStart(int start) {
+    this.characterItem(start, _) or
+    this.isGroupStart(start) or
+    this.charSet(start, _) or
+    this.backreference(start, _) or
+    this.namedCharacterProperty(start, _, _, _)
+  }
+
+  private predicate itemEnd(int end) {
+    this.characterItem(_, end)
+    or
+    exists(int endm1 | this.isGroupEnd(endm1) and end = endm1 + 1)
+    or
+    this.charSet(_, end)
+    or
+    this.qualifier(_, end, _, _)
+  }
+
+  private predicate topLevel(int start, int end) {
+    this.subalternation(start, end, _) and
+    not this.isOptionDivider(end)
+  }
+
+  private predicate subalternation(int start, int end, int itemStart) {
+    this.sequenceOrQualified(start, end) and
+    not this.isOptionDivider(start - 1) and
+    itemStart = start
+    or
+    start = end and
+    not this.itemEnd(start) and
+    this.isOptionDivider(end) and
+    itemStart = start
+    or
+    exists(int mid |
+      this.subalternation(start, mid, _) and
+      this.isOptionDivider(mid) and
+      itemStart = mid + 1
+    |
+      this.sequenceOrQualified(itemStart, end)
+      or
+      not this.itemStart(end) and end = itemStart
+    )
+  }
+
+  /**
+   * Whether the text in the range start,end is an alternation
+   */
+  predicate alternation(int start, int end) {
+    not this.inCharSet(start) and
+    this.topLevel(start, end) and
+    exists(int less | this.subalternation(start, less, _) and less < end)
+  }
+
+  /**
+   * Whether the text in the range start,end is an alternation and the text in partStart, partEnd is one of the
+   * options in that alternation.
+   */
+  predicate alternationOption(int start, int end, int partStart, int partEnd) {
+    this.alternation(start, end) and
+    this.subalternation(start, partEnd, partStart)
+  }
+
+  /** A part of the regex that may match the start of the string. */
+  private predicate firstPart(int start, int end) {
+    start = 0 and end = this.getText().length()
+    or
+    exists(int x | this.firstPart(x, end) |
+      this.emptyMatchAtStartGroup(x, start)
+      or
+      this.qualifiedItem(x, start, true, _)
+      or
+      // ^ matches the start of the string
+      this.specialCharacter(x, start, "^")
+    )
+    or
+    exists(int y | this.firstPart(start, y) |
+      this.item(start, end)
+      or
+      this.qualifiedPart(start, end, y, _, _)
+    )
+    or
+    exists(int x, int y | this.firstPart(x, y) |
+      this.groupContents(x, y, start, end)
+      or
+      this.alternationOption(x, y, start, end)
+    )
+  }
+
+  /** A part of the regex that may match the end of the string. */
+  private predicate lastPart(int start, int end) {
+    start = 0 and end = this.getText().length()
+    or
+    exists(int y | this.lastPart(start, y) |
+      this.emptyMatchAtEndGroup(end, y)
+      or
+      this.qualifiedItem(end, y, true, _)
+      or
+      // $ matches the end of the string.
+      this.specialCharacter(end, y, "$")
+    )
+    or
+    this.lastPart(_, end) and
+    this.item(start, end)
+    or
+    exists(int y | this.lastPart(start, y) | this.qualifiedPart(start, end, y, _, _))
+    or
+    exists(int x, int y | this.lastPart(x, y) |
+      this.groupContents(x, y, start, end)
+      or
+      this.alternationOption(x, y, start, end)
+    )
+  }
+
+  /**
+   * Whether the item at [start, end) is one of the first items
+   * to be matched.
+   */
+  predicate firstItem(int start, int end) {
+    (
+      this.characterItem(start, end)
+      or
+      this.qualifiedItem(start, end, _, _)
+      or
+      this.charSet(start, end)
+    ) and
+    this.firstPart(start, end)
+  }
+
+  /**
+   * Whether the item at [start, end) is one of the last items
+   * to be matched.
+   */
+  predicate lastItem(int start, int end) {
+    (
+      this.characterItem(start, end)
+      or
+      this.qualifiedItem(start, end, _, _)
+      or
+      this.charSet(start, end)
+    ) and
+    this.lastPart(start, end)
+  }
+}
diff --git a/cpp/ql/test/library-tests/regex/locations.expected b/cpp/ql/test/library-tests/regex/locations.expected
new file mode 100644
index 000000000000..a9f12c020d79
--- /dev/null
+++ b/cpp/ql/test/library-tests/regex/locations.expected
@@ -0,0 +1,63 @@
+| regexp.cpp:18:19:18:21 | abc | regexp.cpp | 18 | 19 | 18 | 21 |
+| regexp.cpp:21:20:21:26 | a*b+c?d | regexp.cpp | 21 | 20 | 21 | 26 |
+| regexp.cpp:22:20:22:25 | a{4,8} | regexp.cpp | 22 | 20 | 22 | 25 |
+| regexp.cpp:23:20:23:24 | a{3,} | regexp.cpp | 23 | 20 | 23 | 24 |
+| regexp.cpp:24:20:24:23 | a{7} | regexp.cpp | 24 | 20 | 24 | 23 |
+| regexp.cpp:27:19:27:25 | foo\|bar | regexp.cpp | 27 | 19 | 27 | 25 |
+| regexp.cpp:30:19:30:23 | [abc] | regexp.cpp | 30 | 19 | 30 | 23 |
+| regexp.cpp:31:19:31:30 | [a-fA-F0-9_] | regexp.cpp | 31 | 19 | 31 | 30 |
+| regexp.cpp:32:19:32:23 | [\\w]+ | regexp.cpp | 32 | 19 | 32 | 23 |
+| regexp.cpp:33:19:33:27 | \\[\\][123] | regexp.cpp | 33 | 19 | 33 | 27 |
+| regexp.cpp:34:19:34:24 | [^A-Z] | regexp.cpp | 34 | 19 | 34 | 24 |
+| regexp.cpp:35:19:35:21 | []] | regexp.cpp | 35 | 19 | 35 | 21 |
+| regexp.cpp:36:19:36:22 | [^]] | regexp.cpp | 36 | 19 | 36 | 22 |
+| regexp.cpp:37:19:37:22 | [^-] | regexp.cpp | 37 | 19 | 37 | 22 |
+| regexp.cpp:38:19:38:21 | [\|] | regexp.cpp | 38 | 19 | 38 | 21 |
+| regexp.cpp:39:20:39:23 | [\\b] | regexp.cpp | 39 | 20 | 39 | 23 |
+| regexp.cpp:42:22:42:31 | [[a-f]A-F] | regexp.cpp | 42 | 22 | 42 | 31 |
+| regexp.cpp:45:21:45:22 | .* | regexp.cpp | 45 | 21 | 45 | 22 |
+| regexp.cpp:46:21:46:25 | \\w+\\W | regexp.cpp | 46 | 21 | 46 | 25 |
+| regexp.cpp:47:21:47:24 | \\s\\S | regexp.cpp | 47 | 21 | 47 | 24 |
+| regexp.cpp:48:21:48:24 | \\d\\D | regexp.cpp | 48 | 21 | 48 | 24 |
+| regexp.cpp:49:21:49:26 | \\n\\r\\t | regexp.cpp | 49 | 21 | 49 | 26 |
+| regexp.cpp:52:20:52:25 | \\b!a\\B | regexp.cpp | 52 | 20 | 52 | 25 |
+| regexp.cpp:55:20:55:28 | (foo)*bar | regexp.cpp | 55 | 20 | 55 | 28 |
+| regexp.cpp:56:20:56:28 | fo(o\|b)ar | regexp.cpp | 56 | 20 | 56 | 28 |
+| regexp.cpp:57:20:57:28 | (a\|b\|cd)e | regexp.cpp | 57 | 20 | 57 | 28 |
+| regexp.cpp:58:20:58:27 | (?::+)\\w | regexp.cpp | 58 | 20 | 58 | 27 |
+| regexp.cpp:61:21:61:28 | (a+)b+\\1 | regexp.cpp | 61 | 21 | 61 | 28 |
+| regexp.cpp:64:21:64:32 | [[:alnum:]]* | regexp.cpp | 64 | 21 | 64 | 32 |
+| regexp.cpp:65:21:65:32 | [[:digit:]]+ | regexp.cpp | 65 | 21 | 65 | 32 |
+| regexp.cpp:66:21:66:36 | [[:alnum:]]{2,3} | regexp.cpp | 66 | 21 | 66 | 36 |
+| regexp.cpp:67:21:67:35 | [a-f[:digit:]]+ | regexp.cpp | 67 | 21 | 67 | 35 |
+| regexp.cpp:70:22:70:43 | [[:alpha:]][[:digit:]] | regexp.cpp | 70 | 22 | 70 | 43 |
+| regexp.cpp:73:22:73:41 | [[:alpha:][:digit:]] | regexp.cpp | 73 | 22 | 73 | 41 |
+| regexp.cpp:76:22:76:38 | [A-F[:digit:]a-f] | regexp.cpp | 76 | 22 | 76 | 38 |
+| regexp.cpp:79:27:79:33 | [[.a.]] | regexp.cpp | 79 | 27 | 79 | 33 |
+| regexp.cpp:80:27:80:39 | [A-F[.b.]a-f] | regexp.cpp | 80 | 27 | 80 | 39 |
+| regexp.cpp:83:28:83:34 | [[=a=]] | regexp.cpp | 83 | 28 | 83 | 34 |
+| regexp.cpp:84:28:84:40 | [A-F[=b=]a-f] | regexp.cpp | 84 | 28 | 84 | 40 |
+| regexp.cpp:87:22:87:30 | [:digit:] | regexp.cpp | 87 | 22 | 87 | 30 |
+| regexp.cpp:90:19:90:24 | \\u0061 | regexp.cpp | 90 | 19 | 90 | 24 |
+| regexp.cpp:93:19:93:22 | \\x61 | regexp.cpp | 93 | 19 | 93 | 22 |
+| regexp.cpp:96:21:96:23 | \\cA | regexp.cpp | 96 | 21 | 96 | 23 |
+| regexp.cpp:97:21:97:25 | [\\cz] | regexp.cpp | 97 | 21 | 97 | 25 |
+| regexp.cpp:100:20:100:21 | \\0 | regexp.cpp | 100 | 20 | 100 | 21 |
+| regexp.cpp:101:20:101:23 | [\\0] | regexp.cpp | 101 | 20 | 101 | 23 |
+| regexp.cpp:104:21:104:23 | a*? | regexp.cpp | 104 | 21 | 104 | 23 |
+| regexp.cpp:105:21:105:23 | b+? | regexp.cpp | 105 | 21 | 105 | 23 |
+| regexp.cpp:106:21:106:23 | c?? | regexp.cpp | 106 | 21 | 106 | 23 |
+| regexp.cpp:107:21:107:27 | d{2,3}? | regexp.cpp | 107 | 21 | 107 | 27 |
+| regexp.cpp:108:18:108:21 | \\f\\v | regexp.cpp | 108 | 18 | 108 | 21 |
+| regexp.cpp:111:25:111:28 | a\\nb | regexp.cpp | 111 | 25 | 111 | 28 |
+| regexp.cpp:112:37:112:40 | a\\nc | regexp.cpp | 112 | 37 | 112 | 40 |
+| regexp.cpp:113:39:113:42 | a\\nc | regexp.cpp | 113 | 39 | 113 | 42 |
+| regexp.cpp:114:38:114:41 | a\\nc | regexp.cpp | 114 | 38 | 114 | 41 |
+| regexp.cpp:115:38:115:41 | a\\nc | regexp.cpp | 115 | 38 | 115 | 41 |
+| regexp.cpp:116:23:116:26 | a\\nc | regexp.cpp | 116 | 23 | 116 | 26 |
+| regexp.cpp:117:40:117:43 | a\\nc | regexp.cpp | 117 | 40 | 117 | 43 |
+| regexp.cpp:118:42:118:45 | a\\nc | regexp.cpp | 118 | 42 | 118 | 45 |
+| regexp.cpp:119:41:119:44 | a\\nc | regexp.cpp | 119 | 41 | 119 | 44 |
+| regexp.cpp:120:41:120:44 | a\\nc | regexp.cpp | 120 | 41 | 120 | 44 |
+| regexp.cpp:121:25:121:28 | a\\nc | regexp.cpp | 121 | 25 | 121 | 28 |
+| regexp.cpp:122:29:122:32 | a\\nc | regexp.cpp | 122 | 29 | 122 | 32 |
diff --git a/cpp/ql/test/library-tests/regex/locations.ql b/cpp/ql/test/library-tests/regex/locations.ql
new file mode 100644
index 000000000000..0b6e23f2b79a
--- /dev/null
+++ b/cpp/ql/test/library-tests/regex/locations.ql
@@ -0,0 +1,11 @@
+import semmle.code.cpp.regex.internal.ParseRegExp
+import semmle.code.cpp.regex.RegexTreeView
+
+// Stop gap for missing flow configs
+class RegExpTest extends RegExp {
+  RegExpTest() { any() }
+}
+
+from RegExpTerm t, string file, int sl, int sc, int el, int ec
+where t.isRootTerm() and t.hasLocationInfo(file, sl, sc, el, ec)
+select t, file, sl, sc, el, ec
diff --git a/cpp/ql/test/library-tests/regex/parse.expected b/cpp/ql/test/library-tests/regex/parse.expected
new file mode 100644
index 000000000000..e8d84b277514
--- /dev/null
+++ b/cpp/ql/test/library-tests/regex/parse.expected
@@ -0,0 +1,639 @@
+regexp.cpp:
+#   18| [RegExpConstant, RegExpNormalChar] abc
+
+#   21| [RegExpConstant, RegExpNormalChar] a
+
+#   21| [RegExpStar] a*
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+
+#   21| [RegExpSequence] a*b+c?d
+#-----| 0 -> [RegExpStar] a*
+#-----| 1 -> [RegExpPlus] b+
+#-----| 2 -> [RegExpOpt] c?
+#-----| 3 -> [RegExpConstant, RegExpNormalChar] d
+
+#   21| [RegExpConstant, RegExpNormalChar] b
+
+#   21| [RegExpPlus] b+
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] b
+
+#   21| [RegExpConstant, RegExpNormalChar] c
+
+#   21| [RegExpOpt] c?
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] c
+
+#   21| [RegExpConstant, RegExpNormalChar] d
+
+#   22| [RegExpConstant, RegExpNormalChar] a
+
+#   22| [RegExpRange] a{4,8}
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+
+#   23| [RegExpConstant, RegExpNormalChar] a
+
+#   23| [InfiniteRepetitionQuantifier, RegExpRange] a{3,}
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+
+#   24| [RegExpConstant, RegExpNormalChar] a
+
+#   24| [RegExpRange] a{7}
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+
+#   27| [RegExpConstant, RegExpNormalChar] foo
+
+#   27| [RegExpAlt] foo|bar
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] foo
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] bar
+
+#   27| [RegExpConstant, RegExpNormalChar] bar
+
+#   30| [RegExpCharacterClass] [abc]
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] b
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] c
+
+#   30| [RegExpConstant, RegExpNormalChar] a
+
+#   30| [RegExpConstant, RegExpNormalChar] b
+
+#   30| [RegExpConstant, RegExpNormalChar] c
+
+#   31| [RegExpCharacterClass] [a-fA-F0-9_]
+#-----| 0 -> [RegExpCharacterRange] a-f
+#-----| 1 -> [RegExpCharacterRange] A-F
+#-----| 2 -> [RegExpCharacterRange] 0-9
+#-----| 3 -> [RegExpConstant, RegExpNormalChar] _
+
+#   31| [RegExpConstant, RegExpNormalChar] a
+
+#   31| [RegExpCharacterRange] a-f
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] f
+
+#   31| [RegExpConstant, RegExpNormalChar] f
+
+#   31| [RegExpConstant, RegExpNormalChar] A
+
+#   31| [RegExpCharacterRange] A-F
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] A
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] F
+
+#   31| [RegExpConstant, RegExpNormalChar] F
+
+#   31| [RegExpConstant, RegExpNormalChar] 0
+
+#   31| [RegExpCharacterRange] 0-9
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] 0
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] 9
+
+#   31| [RegExpConstant, RegExpNormalChar] 9
+
+#   31| [RegExpConstant, RegExpNormalChar] _
+
+#   32| [RegExpCharacterClass] [\w]
+#-----| 0 -> [RegExpCharacterClassEscape] \w
+
+#   32| [RegExpPlus] [\w]+
+#-----| 0 -> [RegExpCharacterClass] [\w]
+
+#   32| [RegExpCharacterClassEscape] \w
+
+#   33| [RegExpConstant, RegExpEscape] \[
+
+#   33| [RegExpSequence] \[\][123]
+#-----| 0 -> [RegExpConstant, RegExpEscape] \[
+#-----| 1 -> [RegExpConstant, RegExpEscape] \]
+#-----| 2 -> [RegExpCharacterClass] [123]
+
+#   33| [RegExpConstant, RegExpEscape] \]
+
+#   33| [RegExpCharacterClass] [123]
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] 1
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] 2
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] 3
+
+#   33| [RegExpConstant, RegExpNormalChar] 1
+
+#   33| [RegExpConstant, RegExpNormalChar] 2
+
+#   33| [RegExpConstant, RegExpNormalChar] 3
+
+#   34| [RegExpCharacterClass] [^A-Z]
+#-----| 0 -> [RegExpCharacterRange] A-Z
+
+#   34| [RegExpConstant, RegExpNormalChar] A
+
+#   34| [RegExpCharacterRange] A-Z
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] A
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] Z
+
+#   34| [RegExpConstant, RegExpNormalChar] Z
+
+#   35| [RegExpCharacterClass] []]
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] ]
+
+#   35| [RegExpConstant, RegExpNormalChar] ]
+
+#   36| [RegExpCharacterClass] [^]]
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] ]
+
+#   36| [RegExpConstant, RegExpNormalChar] ]
+
+#   37| [RegExpCharacterClass] [^-]
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] -
+
+#   37| [RegExpConstant, RegExpNormalChar] -
+
+#   38| [RegExpCharacterClass] [|]
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] |
+
+#   38| [RegExpConstant, RegExpNormalChar] |
+
+#   39| [RegExpCharacterClass] [\b]
+#-----| 0 -> [RegExpConstant, RegExpEscape] \b
+
+#   39| [RegExpConstant, RegExpEscape] \b
+
+#   42| [RegExpCharacterClass] [[a-f]
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] [
+#-----| 1 -> [RegExpCharacterRange] a-f
+
+#   42| [RegExpSequence] [[a-f]A-F]
+#-----| 0 -> [RegExpCharacterClass] [[a-f]
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] A-F]
+
+#   42| [RegExpConstant, RegExpNormalChar] [
+
+#   42| [RegExpConstant, RegExpNormalChar] a
+
+#   42| [RegExpCharacterRange] a-f
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] f
+
+#   42| [RegExpConstant, RegExpNormalChar] f
+
+#   42| [RegExpConstant, RegExpNormalChar] A-F]
+
+#   45| [RegExpDot] .
+
+#   45| [RegExpStar] .*
+#-----| 0 -> [RegExpDot] .
+
+#   46| [RegExpCharacterClassEscape] \w
+
+#   46| [RegExpPlus] \w+
+#-----| 0 -> [RegExpCharacterClassEscape] \w
+
+#   46| [RegExpSequence] \w+\W
+#-----| 0 -> [RegExpPlus] \w+
+#-----| 1 -> [RegExpCharacterClassEscape] \W
+
+#   46| [RegExpCharacterClassEscape] \W
+
+#   47| [RegExpCharacterClassEscape] \s
+
+#   47| [RegExpSequence] \s\S
+#-----| 0 -> [RegExpCharacterClassEscape] \s
+#-----| 1 -> [RegExpCharacterClassEscape] \S
+
+#   47| [RegExpCharacterClassEscape] \S
+
+#   48| [RegExpCharacterClassEscape] \d
+
+#   48| [RegExpSequence] \d\D
+#-----| 0 -> [RegExpCharacterClassEscape] \d
+#-----| 1 -> [RegExpCharacterClassEscape] \D
+
+#   48| [RegExpCharacterClassEscape] \D
+
+#   49| [RegExpConstant, RegExpEscape] \n
+
+#   49| [RegExpSequence] \n\r\t
+#-----| 0 -> [RegExpConstant, RegExpEscape] \n
+#-----| 1 -> [RegExpConstant, RegExpEscape] \r
+#-----| 2 -> [RegExpConstant, RegExpEscape] \t
+
+#   49| [RegExpConstant, RegExpEscape] \r
+
+#   49| [RegExpConstant, RegExpEscape] \t
+
+#   52| [RegExpSpecialChar] \b
+
+#   52| [RegExpSequence] \b!a\B
+#-----| 0 -> [RegExpSpecialChar] \b
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] !a
+#-----| 2 -> [RegExpNonWordBoundary] \B
+
+#   52| [RegExpConstant, RegExpNormalChar] !a
+
+#   52| [RegExpNonWordBoundary] \B
+
+#   55| [RegExpGroup] (foo)
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] foo
+
+#   55| [RegExpStar] (foo)*
+#-----| 0 -> [RegExpGroup] (foo)
+
+#   55| [RegExpSequence] (foo)*bar
+#-----| 0 -> [RegExpStar] (foo)*
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] bar
+
+#   55| [RegExpConstant, RegExpNormalChar] foo
+
+#   55| [RegExpConstant, RegExpNormalChar] bar
+
+#   56| [RegExpConstant, RegExpNormalChar] fo
+
+#   56| [RegExpSequence] fo(o|b)ar
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] fo
+#-----| 1 -> [RegExpGroup] (o|b)
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] ar
+
+#   56| [RegExpGroup] (o|b)
+#-----| 0 -> [RegExpAlt] o|b
+
+#   56| [RegExpConstant, RegExpNormalChar] o
+
+#   56| [RegExpAlt] o|b
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] o
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] b
+
+#   56| [RegExpConstant, RegExpNormalChar] b
+
+#   56| [RegExpConstant, RegExpNormalChar] ar
+
+#   57| [RegExpGroup] (a|b|cd)
+#-----| 0 -> [RegExpAlt] a|b|cd
+
+#   57| [RegExpSequence] (a|b|cd)e
+#-----| 0 -> [RegExpGroup] (a|b|cd)
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] e
+
+#   57| [RegExpConstant, RegExpNormalChar] a
+
+#   57| [RegExpAlt] a|b|cd
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] b
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] cd
+
+#   57| [RegExpConstant, RegExpNormalChar] b
+
+#   57| [RegExpConstant, RegExpNormalChar] cd
+
+#   57| [RegExpConstant, RegExpNormalChar] e
+
+#   58| [RegExpGroup] (?::+)
+#-----| 0 -> [RegExpPlus] :+
+
+#   58| [RegExpSequence] (?::+)\w
+#-----| 0 -> [RegExpGroup] (?::+)
+#-----| 1 -> [RegExpCharacterClassEscape] \w
+
+#   58| [RegExpConstant, RegExpNormalChar] :
+
+#   58| [RegExpPlus] :+
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] :
+
+#   58| [RegExpCharacterClassEscape] \w
+
+#   61| [RegExpGroup] (a+)
+#-----| 0 -> [RegExpPlus] a+
+
+#   61| [RegExpSequence] (a+)b+\1
+#-----| 0 -> [RegExpGroup] (a+)
+#-----| 1 -> [RegExpPlus] b+
+#-----| 2 -> [RegExpBackRef] \1
+
+#   61| [RegExpConstant, RegExpNormalChar] a
+
+#   61| [RegExpPlus] a+
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+
+#   61| [RegExpConstant, RegExpNormalChar] b
+
+#   61| [RegExpPlus] b+
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] b
+
+#   61| [RegExpBackRef] \1
+
+#   64| [RegExpCharacterClass] [[:alnum:]]
+#-----| 0 -> [RegExpNamedCharacterProperty] [:alnum:]
+
+#   64| [RegExpStar] [[:alnum:]]*
+#-----| 0 -> [RegExpCharacterClass] [[:alnum:]]
+
+#   64| [RegExpNamedCharacterProperty] [:alnum:]
+
+#   65| [RegExpCharacterClass] [[:digit:]]
+#-----| 0 -> [RegExpNamedCharacterProperty] [:digit:]
+
+#   65| [RegExpPlus] [[:digit:]]+
+#-----| 0 -> [RegExpCharacterClass] [[:digit:]]
+
+#   65| [RegExpNamedCharacterProperty] [:digit:]
+
+#   66| [RegExpCharacterClass] [[:alnum:]]
+#-----| 0 -> [RegExpNamedCharacterProperty] [:alnum:]
+
+#   66| [RegExpRange] [[:alnum:]]{2,3}
+#-----| 0 -> [RegExpCharacterClass] [[:alnum:]]
+
+#   66| [RegExpNamedCharacterProperty] [:alnum:]
+
+#   67| [RegExpCharacterClass] [a-f[:digit:]]
+#-----| 0 -> [RegExpCharacterRange] a-f
+#-----| 1 -> [RegExpNamedCharacterProperty] [:digit:]
+
+#   67| [RegExpPlus] [a-f[:digit:]]+
+#-----| 0 -> [RegExpCharacterClass] [a-f[:digit:]]
+
+#   67| [RegExpConstant, RegExpNormalChar] a
+
+#   67| [RegExpCharacterRange] a-f
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] f
+
+#   67| [RegExpConstant, RegExpNormalChar] f
+
+#   67| [RegExpNamedCharacterProperty] [:digit:]
+
+#   70| [RegExpCharacterClass] [[:alpha:]]
+#-----| 0 -> [RegExpNamedCharacterProperty] [:alpha:]
+
+#   70| [RegExpSequence] [[:alpha:]][[:digit:]]
+#-----| 0 -> [RegExpCharacterClass] [[:alpha:]]
+#-----| 1 -> [RegExpCharacterClass] [[:digit:]]
+
+#   70| [RegExpNamedCharacterProperty] [:alpha:]
+
+#   70| [RegExpCharacterClass] [[:digit:]]
+#-----| 0 -> [RegExpNamedCharacterProperty] [:digit:]
+
+#   70| [RegExpNamedCharacterProperty] [:digit:]
+
+#   73| [RegExpCharacterClass] [[:alpha:][:digit:]]
+#-----| 0 -> [RegExpNamedCharacterProperty] [:alpha:]
+#-----| 1 -> [RegExpNamedCharacterProperty] [:digit:]
+
+#   73| [RegExpNamedCharacterProperty] [:alpha:]
+
+#   73| [RegExpNamedCharacterProperty] [:digit:]
+
+#   76| [RegExpCharacterClass] [A-F[:digit:]a-f]
+#-----| 0 -> [RegExpCharacterRange] A-F
+#-----| 1 -> [RegExpNamedCharacterProperty] [:digit:]
+#-----| 2 -> [RegExpCharacterRange] a-f
+
+#   76| [RegExpConstant, RegExpNormalChar] A
+
+#   76| [RegExpCharacterRange] A-F
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] A
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] F
+
+#   76| [RegExpConstant, RegExpNormalChar] F
+
+#   76| [RegExpNamedCharacterProperty] [:digit:]
+
+#   76| [RegExpConstant, RegExpNormalChar] a
+
+#   76| [RegExpCharacterRange] a-f
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] f
+
+#   76| [RegExpConstant, RegExpNormalChar] f
+
+#   79| [RegExpCharacterClass] [[.a.]]
+#-----| 0 -> [RegExpNamedCharacterProperty] [.a.]
+
+#   79| [RegExpNamedCharacterProperty] [.a.]
+
+#   80| [RegExpCharacterClass] [A-F[.b.]a-f]
+#-----| 0 -> [RegExpCharacterRange] A-F
+#-----| 1 -> [RegExpNamedCharacterProperty] [.b.]
+#-----| 2 -> [RegExpCharacterRange] a-f
+
+#   80| [RegExpConstant, RegExpNormalChar] A
+
+#   80| [RegExpCharacterRange] A-F
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] A
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] F
+
+#   80| [RegExpConstant, RegExpNormalChar] F
+
+#   80| [RegExpNamedCharacterProperty] [.b.]
+
+#   80| [RegExpConstant, RegExpNormalChar] a
+
+#   80| [RegExpCharacterRange] a-f
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] f
+
+#   80| [RegExpConstant, RegExpNormalChar] f
+
+#   83| [RegExpCharacterClass] [[=a=]]
+#-----| 0 -> [RegExpNamedCharacterProperty] [=a=]
+
+#   83| [RegExpNamedCharacterProperty] [=a=]
+
+#   84| [RegExpCharacterClass] [A-F[=b=]a-f]
+#-----| 0 -> [RegExpCharacterRange] A-F
+#-----| 1 -> [RegExpNamedCharacterProperty] [=b=]
+#-----| 2 -> [RegExpCharacterRange] a-f
+
+#   84| [RegExpConstant, RegExpNormalChar] A
+
+#   84| [RegExpCharacterRange] A-F
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] A
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] F
+
+#   84| [RegExpConstant, RegExpNormalChar] F
+
+#   84| [RegExpNamedCharacterProperty] [=b=]
+
+#   84| [RegExpConstant, RegExpNormalChar] a
+
+#   84| [RegExpCharacterRange] a-f
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpNormalChar] f
+
+#   84| [RegExpConstant, RegExpNormalChar] f
+
+#   87| [RegExpNamedCharacterProperty] [:digit:]
+
+#   90| [RegExpConstant, RegExpEscape] \u0061
+
+#   93| [RegExpConstant, RegExpEscape] \x61
+
+#   96| [RegExpConstant, RegExpEscape] \cA
+
+#   97| [RegExpCharacterClass] [\cz]
+#-----| 0 -> [RegExpConstant, RegExpEscape] \cz
+
+#   97| [RegExpConstant, RegExpEscape] \cz
+
+#  100| [RegExpConstant, RegExpEscape] \0
+
+#  101| [RegExpCharacterClass] [\0]
+#-----| 0 -> [RegExpConstant, RegExpEscape] \0
+
+#  101| [RegExpConstant, RegExpEscape] \0
+
+#  104| [RegExpConstant, RegExpNormalChar] a
+
+#  104| [RegExpStar] a*?
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+
+#  105| [RegExpConstant, RegExpNormalChar] b
+
+#  105| [RegExpPlus] b+?
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] b
+
+#  106| [RegExpConstant, RegExpNormalChar] c
+
+#  106| [RegExpOpt] c??
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] c
+
+#  107| [RegExpConstant, RegExpNormalChar] d
+
+#  107| [RegExpQuantifier] d{2,3}?
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] d
+
+#  108| [RegExpConstant, RegExpEscape] \f
+
+#  108| [RegExpSequence] \f\v
+#-----| 0 -> [RegExpConstant, RegExpEscape] \f
+#-----| 1 -> [RegExpConstant, RegExpEscape] \v
+
+#  108| [RegExpConstant, RegExpEscape] \v
+
+#  111| [RegExpConstant, RegExpNormalChar] a
+
+#  111| [RegExpSequence] a\nb
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpEscape] \n
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] b
+
+#  111| [RegExpConstant, RegExpEscape] \n
+
+#  111| [RegExpConstant, RegExpNormalChar] b
+
+#  112| [RegExpConstant, RegExpNormalChar] a
+
+#  112| [RegExpSequence] a\nc
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpEscape] \n
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] c
+
+#  112| [RegExpConstant, RegExpEscape] \n
+
+#  112| [RegExpConstant, RegExpNormalChar] c
+
+#  113| [RegExpConstant, RegExpNormalChar] a
+
+#  113| [RegExpSequence] a\nc
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpEscape] \n
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] c
+
+#  113| [RegExpConstant, RegExpEscape] \n
+
+#  113| [RegExpConstant, RegExpNormalChar] c
+
+#  114| [RegExpConstant, RegExpNormalChar] a
+
+#  114| [RegExpSequence] a\nc
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpEscape] \n
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] c
+
+#  114| [RegExpConstant, RegExpEscape] \n
+
+#  114| [RegExpConstant, RegExpNormalChar] c
+
+#  115| [RegExpConstant, RegExpNormalChar] a
+
+#  115| [RegExpSequence] a\nc
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpEscape] \n
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] c
+
+#  115| [RegExpConstant, RegExpEscape] \n
+
+#  115| [RegExpConstant, RegExpNormalChar] c
+
+#  116| [RegExpConstant, RegExpNormalChar] a
+
+#  116| [RegExpSequence] a\nc
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpEscape] \n
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] c
+
+#  116| [RegExpConstant, RegExpEscape] \n
+
+#  116| [RegExpConstant, RegExpNormalChar] c
+
+#  117| [RegExpConstant, RegExpNormalChar] a
+
+#  117| [RegExpSequence] a\nc
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpEscape] \n
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] c
+
+#  117| [RegExpConstant, RegExpEscape] \n
+
+#  117| [RegExpConstant, RegExpNormalChar] c
+
+#  118| [RegExpConstant, RegExpNormalChar] a
+
+#  118| [RegExpSequence] a\nc
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpEscape] \n
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] c
+
+#  118| [RegExpConstant, RegExpEscape] \n
+
+#  118| [RegExpConstant, RegExpNormalChar] c
+
+#  119| [RegExpConstant, RegExpNormalChar] a
+
+#  119| [RegExpSequence] a\nc
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpEscape] \n
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] c
+
+#  119| [RegExpConstant, RegExpEscape] \n
+
+#  119| [RegExpConstant, RegExpNormalChar] c
+
+#  120| [RegExpConstant, RegExpNormalChar] a
+
+#  120| [RegExpSequence] a\nc
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpEscape] \n
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] c
+
+#  120| [RegExpConstant, RegExpEscape] \n
+
+#  120| [RegExpConstant, RegExpNormalChar] c
+
+#  121| [RegExpConstant, RegExpNormalChar] a
+
+#  121| [RegExpSequence] a\nc
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpEscape] \n
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] c
+
+#  121| [RegExpConstant, RegExpEscape] \n
+
+#  121| [RegExpConstant, RegExpNormalChar] c
+
+#  122| [RegExpConstant, RegExpNormalChar] a
+
+#  122| [RegExpSequence] a\nc
+#-----| 0 -> [RegExpConstant, RegExpNormalChar] a
+#-----| 1 -> [RegExpConstant, RegExpEscape] \n
+#-----| 2 -> [RegExpConstant, RegExpNormalChar] c
+
+#  122| [RegExpConstant, RegExpEscape] \n
+
+#  122| [RegExpConstant, RegExpNormalChar] c
diff --git a/cpp/ql/test/library-tests/regex/parse.ql b/cpp/ql/test/library-tests/regex/parse.ql
new file mode 100644
index 000000000000..2e9debf3784a
--- /dev/null
+++ b/cpp/ql/test/library-tests/regex/parse.ql
@@ -0,0 +1,32 @@
+/**
+ * @kind graph
+ */
+
+import semmle.code.cpp.regex.internal.ParseRegExp
+import semmle.code.cpp.regex.RegexTreeView
+
+// Stop gap for missing flow configs
+class RegExpTest extends RegExp {
+  RegExpTest() { any() }
+}
+
+query predicate nodes(RegExpTerm n, string attr, string val) {
+  attr = "semmle.label" and
+  val = "[" + concat(n.getAPrimaryQlClass(), ", ") + "] " + n.toString()
+  or
+  attr = "semmle.order" and
+  val =
+    any(int i |
+      n =
+        rank[i](RegExpTerm t, string fp, int sl, int sc, int el, int ec |
+          t.hasLocationInfo(fp, sl, sc, el, ec)
+        |
+          t order by fp, sl, sc, el, ec, t.toString()
+        )
+    ).toString()
+}
+
+query predicate edges(RegExpTerm pred, RegExpTerm succ, string attr, string val) {
+  attr in ["semmle.label", "semmle.order"] and
+  val = any(int i | succ = pred.getChild(i)).toString()
+}
diff --git a/cpp/ql/test/library-tests/regex/regexp.cpp b/cpp/ql/test/library-tests/regex/regexp.cpp
new file mode 100644
index 000000000000..51986dd59adf
--- /dev/null
+++ b/cpp/ql/test/library-tests/regex/regexp.cpp
@@ -0,0 +1,122 @@
+// semmle-extractor-options: -std=c++20
+
+namespace std {
+  template <class CharT>
+  class basic_regex {
+  public:
+    basic_regex(const CharT *s) {}
+    basic_regex(const CharT *s, int flags) {}
+    basic_regex &assign(const CharT *s) { return *this; }
+  };
+  typedef basic_regex<char> regex;
+} // namespace std
+
+// Empty
+std::regex r_empty("");
+
+// Basic sequence
+std::regex r_abc("abc");
+
+// Repetition
+std::regex r_rep1("a*b+c?d");
+std::regex r_rep2("a{4,8}");
+std::regex r_rep3("a{3,}");
+std::regex r_rep4("a{7}");
+
+// Alternation
+std::regex r_alt("foo|bar");
+
+// Character classes
+std::regex r_cc1("[abc]");
+std::regex r_cc2("[a-fA-F0-9_]");
+std::regex r_cc3("[\\w]+");
+std::regex r_cc4("\\[\\][123]");
+std::regex r_cc5("[^A-Z]");
+std::regex r_cc6("[]]");   // MRI gives a warning, but accepts this as matching ']'
+std::regex r_cc7("[^]]"); // MRI gives a warning, but accepts this as matching anything except ']'
+std::regex r_cc8("[^-]");
+std::regex r_cc9("[|]");
+std::regex r_cc10("[\\b]");
+
+// Nested character classes (BAD - not parsed correctly)
+std::regex r_nested("[[a-f]A-F]");
+
+// Meta-character classes
+std::regex r_meta1(".*");
+std::regex r_meta2("\\w+\\W");
+std::regex r_meta3("\\s\\S");
+std::regex r_meta4("\\d\\D");
+std::regex r_meta5("\\n\\r\\t");
+
+// Anchors
+std::regex r_anc1("\\b!a\\B");
+
+// Groups
+std::regex r_grp1("(foo)*bar");
+std::regex r_grp2("fo(o|b)ar");
+std::regex r_grp3("(a|b|cd)e");
+std::regex r_grp4("(?::+)\\w"); // Non-capturing group matching colons
+
+// Backreferences
+std::regex r_bref1("(a+)b+\\1");
+
+// Named character properties using a single POSIX bracket expression
+std::regex r_prop1("[[:alnum:]]*");
+std::regex r_prop2("[[:digit:]]+");
+std::regex r_prop3("[[:alnum:]]{2,3}");
+std::regex r_prop4("[a-f[:digit:]]+"); // Also valid inside character classes
+
+// Two separate character classes, each containing a single POSIX bracket expression
+std::regex r_posix1("[[:alpha:]][[:digit:]]");
+
+// A single character class containing two POSIX bracket expressions
+std::regex r_posix2("[[:alpha:][:digit:]]");
+
+// A single character class containing two ranges and one POSIX bracket expression
+std::regex r_posix3("[A-F[:digit:]a-f]");
+
+// POSIX collating symbols
+std::regex r_posix_coll1("[[.a.]]");
+std::regex r_posix_coll2("[A-F[.b.]a-f]");
+
+// POSIX equivalence classes
+std::regex r_posix_equiv1("[[=a=]]");
+std::regex r_posix_equiv2("[A-F[=b=]a-f]");
+
+// *Not* a POSIX bracket expression; just a regular character class.
+std::regex r_posix4("[:digit:]");
+
+// unicode
+std::regex r_uni("\\u0061");
+
+// hex
+std::regex r_hex("\\x61");
+
+// control escapes
+std::regex r_ctrl1("\\cA");
+std::regex r_ctrl2("[\\cz]");
+
+// NUL escape
+std::regex r_nul1("\\0");
+std::regex r_nul2("[\\0]");
+
+// Lazy quantifiers and additional supported escapes
+std::regex r_lazy1("a*?");
+std::regex r_lazy2("b+?");
+std::regex r_lazy3("c??");
+std::regex r_lazy4("d{2,3}?");
+std::regex r_fv("\\f\\v");
+
+// String literal spellings for location tests
+std::regex r_loc_plain("a\\nb");
+std::basic_regex<wchar_t> r_loc_L(L"a\\nc");
+std::basic_regex<char8_t> r_loc_u8(u8"a\\nc");
+std::basic_regex<char16_t> r_loc_u(u"a\\nc");
+std::basic_regex<char32_t> r_loc_U(U"a\\nc");
+std::regex r_loc_R(R"(a\nc)");
+std::basic_regex<wchar_t> r_loc_LR(LR"(a\nc)");
+std::basic_regex<char8_t> r_loc_u8R(u8R"(a\nc)");
+std::basic_regex<char16_t> r_loc_uR(uR"(a\nc)");
+std::basic_regex<char32_t> r_loc_UR(UR"(a\nc)");
+std::regex r_loc_Rx(R"x(a\nc)x");
+std::regex r_loc_Rfoo(R"foo(a\nc)foo");
diff --git a/cpp/ql/test/library-tests/regex/regexp.expected b/cpp/ql/test/library-tests/regex/regexp.expected
new file mode 100644
index 000000000000..6e7a4cfc7204
--- /dev/null
+++ b/cpp/ql/test/library-tests/regex/regexp.expected
@@ -0,0 +1,364 @@
+groupNumber
+| regexp.cpp:55:20:55:24 | (foo) | 1 |
+| regexp.cpp:56:22:56:26 | (o\|b) | 1 |
+| regexp.cpp:57:20:57:27 | (a\|b\|cd) | 1 |
+| regexp.cpp:61:21:61:24 | (a+) | 1 |
+term
+| regexp.cpp:18:19:18:21 | abc | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:21:20:21:20 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:21:20:21:21 | a* | RegExpStar |
+| regexp.cpp:21:20:21:26 | a*b+c?d | RegExpSequence |
+| regexp.cpp:21:22:21:22 | b | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:21:22:21:23 | b+ | RegExpPlus |
+| regexp.cpp:21:24:21:24 | c | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:21:24:21:25 | c? | RegExpOpt |
+| regexp.cpp:21:26:21:26 | d | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:22:20:22:20 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:22:20:22:25 | a{4,8} | RegExpRange |
+| regexp.cpp:23:20:23:20 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:23:20:23:24 | a{3,} | InfiniteRepetitionQuantifier,RegExpRange |
+| regexp.cpp:24:20:24:20 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:24:20:24:23 | a{7} | RegExpRange |
+| regexp.cpp:27:19:27:21 | foo | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:27:19:27:25 | foo\|bar | RegExpAlt |
+| regexp.cpp:27:23:27:25 | bar | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:30:19:30:23 | [abc] | RegExpCharacterClass |
+| regexp.cpp:30:20:30:20 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:30:21:30:21 | b | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:30:22:30:22 | c | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:31:19:31:30 | [a-fA-F0-9_] | RegExpCharacterClass |
+| regexp.cpp:31:20:31:20 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:31:20:31:22 | a-f | RegExpCharacterRange |
+| regexp.cpp:31:22:31:22 | f | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:31:23:31:23 | A | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:31:23:31:25 | A-F | RegExpCharacterRange |
+| regexp.cpp:31:25:31:25 | F | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:31:26:31:26 | 0 | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:31:26:31:28 | 0-9 | RegExpCharacterRange |
+| regexp.cpp:31:28:31:28 | 9 | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:31:29:31:29 | _ | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:32:19:32:22 | [\\w] | RegExpCharacterClass |
+| regexp.cpp:32:19:32:23 | [\\w]+ | RegExpPlus |
+| regexp.cpp:32:20:32:21 | \\w | RegExpCharacterClassEscape |
+| regexp.cpp:33:19:33:20 | \\[ | RegExpConstant,RegExpEscape |
+| regexp.cpp:33:19:33:27 | \\[\\][123] | RegExpSequence |
+| regexp.cpp:33:21:33:22 | \\] | RegExpConstant,RegExpEscape |
+| regexp.cpp:33:23:33:27 | [123] | RegExpCharacterClass |
+| regexp.cpp:33:24:33:24 | 1 | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:33:25:33:25 | 2 | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:33:26:33:26 | 3 | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:34:19:34:24 | [^A-Z] | RegExpCharacterClass |
+| regexp.cpp:34:21:34:21 | A | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:34:21:34:23 | A-Z | RegExpCharacterRange |
+| regexp.cpp:34:23:34:23 | Z | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:35:19:35:21 | []] | RegExpCharacterClass |
+| regexp.cpp:35:20:35:20 | ] | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:36:19:36:22 | [^]] | RegExpCharacterClass |
+| regexp.cpp:36:21:36:21 | ] | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:37:19:37:22 | [^-] | RegExpCharacterClass |
+| regexp.cpp:37:21:37:21 | - | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:38:19:38:21 | [\|] | RegExpCharacterClass |
+| regexp.cpp:38:20:38:20 | \| | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:39:20:39:23 | [\\b] | RegExpCharacterClass |
+| regexp.cpp:39:21:39:22 | \\b | RegExpConstant,RegExpEscape |
+| regexp.cpp:42:22:42:27 | [[a-f] | RegExpCharacterClass |
+| regexp.cpp:42:22:42:31 | [[a-f]A-F] | RegExpSequence |
+| regexp.cpp:42:23:42:23 | [ | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:42:24:42:24 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:42:24:42:26 | a-f | RegExpCharacterRange |
+| regexp.cpp:42:26:42:26 | f | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:42:28:42:31 | A-F] | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:45:21:45:21 | . | RegExpDot |
+| regexp.cpp:45:21:45:22 | .* | RegExpStar |
+| regexp.cpp:46:21:46:22 | \\w | RegExpCharacterClassEscape |
+| regexp.cpp:46:21:46:23 | \\w+ | RegExpPlus |
+| regexp.cpp:46:21:46:25 | \\w+\\W | RegExpSequence |
+| regexp.cpp:46:24:46:25 | \\W | RegExpCharacterClassEscape |
+| regexp.cpp:47:21:47:22 | \\s | RegExpCharacterClassEscape |
+| regexp.cpp:47:21:47:24 | \\s\\S | RegExpSequence |
+| regexp.cpp:47:23:47:24 | \\S | RegExpCharacterClassEscape |
+| regexp.cpp:48:21:48:22 | \\d | RegExpCharacterClassEscape |
+| regexp.cpp:48:21:48:24 | \\d\\D | RegExpSequence |
+| regexp.cpp:48:23:48:24 | \\D | RegExpCharacterClassEscape |
+| regexp.cpp:49:21:49:22 | \\n | RegExpConstant,RegExpEscape |
+| regexp.cpp:49:21:49:26 | \\n\\r\\t | RegExpSequence |
+| regexp.cpp:49:23:49:24 | \\r | RegExpConstant,RegExpEscape |
+| regexp.cpp:49:25:49:26 | \\t | RegExpConstant,RegExpEscape |
+| regexp.cpp:52:20:52:21 | \\b | RegExpSpecialChar |
+| regexp.cpp:52:20:52:25 | \\b!a\\B | RegExpSequence |
+| regexp.cpp:52:22:52:23 | !a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:52:24:52:25 | \\B | RegExpNonWordBoundary |
+| regexp.cpp:55:20:55:24 | (foo) | RegExpGroup |
+| regexp.cpp:55:20:55:25 | (foo)* | RegExpStar |
+| regexp.cpp:55:20:55:28 | (foo)*bar | RegExpSequence |
+| regexp.cpp:55:21:55:23 | foo | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:55:26:55:28 | bar | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:56:20:56:21 | fo | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:56:20:56:28 | fo(o\|b)ar | RegExpSequence |
+| regexp.cpp:56:22:56:26 | (o\|b) | RegExpGroup |
+| regexp.cpp:56:23:56:23 | o | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:56:23:56:25 | o\|b | RegExpAlt |
+| regexp.cpp:56:25:56:25 | b | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:56:27:56:28 | ar | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:57:20:57:27 | (a\|b\|cd) | RegExpGroup |
+| regexp.cpp:57:20:57:28 | (a\|b\|cd)e | RegExpSequence |
+| regexp.cpp:57:21:57:21 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:57:21:57:26 | a\|b\|cd | RegExpAlt |
+| regexp.cpp:57:23:57:23 | b | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:57:25:57:26 | cd | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:57:28:57:28 | e | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:58:20:58:25 | (?::+) | RegExpGroup |
+| regexp.cpp:58:20:58:27 | (?::+)\\w | RegExpSequence |
+| regexp.cpp:58:23:58:23 | : | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:58:23:58:24 | :+ | RegExpPlus |
+| regexp.cpp:58:26:58:27 | \\w | RegExpCharacterClassEscape |
+| regexp.cpp:61:21:61:24 | (a+) | RegExpGroup |
+| regexp.cpp:61:21:61:28 | (a+)b+\\1 | RegExpSequence |
+| regexp.cpp:61:22:61:22 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:61:22:61:23 | a+ | RegExpPlus |
+| regexp.cpp:61:25:61:25 | b | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:61:25:61:26 | b+ | RegExpPlus |
+| regexp.cpp:61:27:61:28 | \\1 | RegExpBackRef |
+| regexp.cpp:64:21:64:31 | [[:alnum:]] | RegExpCharacterClass |
+| regexp.cpp:64:21:64:32 | [[:alnum:]]* | RegExpStar |
+| regexp.cpp:64:22:64:30 | [:alnum:] | RegExpNamedCharacterProperty |
+| regexp.cpp:65:21:65:31 | [[:digit:]] | RegExpCharacterClass |
+| regexp.cpp:65:21:65:32 | [[:digit:]]+ | RegExpPlus |
+| regexp.cpp:65:22:65:30 | [:digit:] | RegExpNamedCharacterProperty |
+| regexp.cpp:66:21:66:31 | [[:alnum:]] | RegExpCharacterClass |
+| regexp.cpp:66:21:66:36 | [[:alnum:]]{2,3} | RegExpRange |
+| regexp.cpp:66:22:66:30 | [:alnum:] | RegExpNamedCharacterProperty |
+| regexp.cpp:67:21:67:34 | [a-f[:digit:]] | RegExpCharacterClass |
+| regexp.cpp:67:21:67:35 | [a-f[:digit:]]+ | RegExpPlus |
+| regexp.cpp:67:22:67:22 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:67:22:67:24 | a-f | RegExpCharacterRange |
+| regexp.cpp:67:24:67:24 | f | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:67:25:67:33 | [:digit:] | RegExpNamedCharacterProperty |
+| regexp.cpp:70:22:70:32 | [[:alpha:]] | RegExpCharacterClass |
+| regexp.cpp:70:22:70:43 | [[:alpha:]][[:digit:]] | RegExpSequence |
+| regexp.cpp:70:23:70:31 | [:alpha:] | RegExpNamedCharacterProperty |
+| regexp.cpp:70:33:70:43 | [[:digit:]] | RegExpCharacterClass |
+| regexp.cpp:70:34:70:42 | [:digit:] | RegExpNamedCharacterProperty |
+| regexp.cpp:73:22:73:41 | [[:alpha:][:digit:]] | RegExpCharacterClass |
+| regexp.cpp:73:23:73:31 | [:alpha:] | RegExpNamedCharacterProperty |
+| regexp.cpp:73:32:73:40 | [:digit:] | RegExpNamedCharacterProperty |
+| regexp.cpp:76:22:76:38 | [A-F[:digit:]a-f] | RegExpCharacterClass |
+| regexp.cpp:76:23:76:23 | A | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:76:23:76:25 | A-F | RegExpCharacterRange |
+| regexp.cpp:76:25:76:25 | F | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:76:26:76:34 | [:digit:] | RegExpNamedCharacterProperty |
+| regexp.cpp:76:35:76:35 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:76:35:76:37 | a-f | RegExpCharacterRange |
+| regexp.cpp:76:37:76:37 | f | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:79:27:79:33 | [[.a.]] | RegExpCharacterClass |
+| regexp.cpp:79:28:79:32 | [.a.] | RegExpNamedCharacterProperty |
+| regexp.cpp:80:27:80:39 | [A-F[.b.]a-f] | RegExpCharacterClass |
+| regexp.cpp:80:28:80:28 | A | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:80:28:80:30 | A-F | RegExpCharacterRange |
+| regexp.cpp:80:30:80:30 | F | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:80:31:80:35 | [.b.] | RegExpNamedCharacterProperty |
+| regexp.cpp:80:36:80:36 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:80:36:80:38 | a-f | RegExpCharacterRange |
+| regexp.cpp:80:38:80:38 | f | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:83:28:83:34 | [[=a=]] | RegExpCharacterClass |
+| regexp.cpp:83:29:83:33 | [=a=] | RegExpNamedCharacterProperty |
+| regexp.cpp:84:28:84:40 | [A-F[=b=]a-f] | RegExpCharacterClass |
+| regexp.cpp:84:29:84:29 | A | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:84:29:84:31 | A-F | RegExpCharacterRange |
+| regexp.cpp:84:31:84:31 | F | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:84:32:84:36 | [=b=] | RegExpNamedCharacterProperty |
+| regexp.cpp:84:37:84:37 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:84:37:84:39 | a-f | RegExpCharacterRange |
+| regexp.cpp:84:39:84:39 | f | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:87:22:87:30 | [:digit:] | RegExpNamedCharacterProperty |
+| regexp.cpp:90:19:90:24 | \\u0061 | RegExpConstant,RegExpEscape |
+| regexp.cpp:93:19:93:22 | \\x61 | RegExpConstant,RegExpEscape |
+| regexp.cpp:96:21:96:23 | \\cA | RegExpConstant,RegExpEscape |
+| regexp.cpp:97:21:97:25 | [\\cz] | RegExpCharacterClass |
+| regexp.cpp:97:22:97:24 | \\cz | RegExpConstant,RegExpEscape |
+| regexp.cpp:100:20:100:21 | \\0 | RegExpConstant,RegExpEscape |
+| regexp.cpp:101:20:101:23 | [\\0] | RegExpCharacterClass |
+| regexp.cpp:101:21:101:22 | \\0 | RegExpConstant,RegExpEscape |
+| regexp.cpp:104:21:104:21 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:104:21:104:23 | a*? | RegExpStar |
+| regexp.cpp:105:21:105:21 | b | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:105:21:105:23 | b+? | RegExpPlus |
+| regexp.cpp:106:21:106:21 | c | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:106:21:106:23 | c?? | RegExpOpt |
+| regexp.cpp:107:21:107:21 | d | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:107:21:107:27 | d{2,3}? | RegExpQuantifier |
+| regexp.cpp:108:18:108:19 | \\f | RegExpConstant,RegExpEscape |
+| regexp.cpp:108:18:108:21 | \\f\\v | RegExpSequence |
+| regexp.cpp:108:20:108:21 | \\v | RegExpConstant,RegExpEscape |
+| regexp.cpp:111:25:111:25 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:111:25:111:28 | a\\nb | RegExpSequence |
+| regexp.cpp:111:26:111:27 | \\n | RegExpConstant,RegExpEscape |
+| regexp.cpp:111:28:111:28 | b | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:112:37:112:37 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:112:37:112:40 | a\\nc | RegExpSequence |
+| regexp.cpp:112:38:112:39 | \\n | RegExpConstant,RegExpEscape |
+| regexp.cpp:112:40:112:40 | c | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:113:39:113:39 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:113:39:113:42 | a\\nc | RegExpSequence |
+| regexp.cpp:113:40:113:41 | \\n | RegExpConstant,RegExpEscape |
+| regexp.cpp:113:42:113:42 | c | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:114:38:114:38 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:114:38:114:41 | a\\nc | RegExpSequence |
+| regexp.cpp:114:39:114:40 | \\n | RegExpConstant,RegExpEscape |
+| regexp.cpp:114:41:114:41 | c | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:115:38:115:38 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:115:38:115:41 | a\\nc | RegExpSequence |
+| regexp.cpp:115:39:115:40 | \\n | RegExpConstant,RegExpEscape |
+| regexp.cpp:115:41:115:41 | c | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:116:23:116:23 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:116:23:116:26 | a\\nc | RegExpSequence |
+| regexp.cpp:116:24:116:25 | \\n | RegExpConstant,RegExpEscape |
+| regexp.cpp:116:26:116:26 | c | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:117:40:117:40 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:117:40:117:43 | a\\nc | RegExpSequence |
+| regexp.cpp:117:41:117:42 | \\n | RegExpConstant,RegExpEscape |
+| regexp.cpp:117:43:117:43 | c | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:118:42:118:42 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:118:42:118:45 | a\\nc | RegExpSequence |
+| regexp.cpp:118:43:118:44 | \\n | RegExpConstant,RegExpEscape |
+| regexp.cpp:118:45:118:45 | c | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:119:41:119:41 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:119:41:119:44 | a\\nc | RegExpSequence |
+| regexp.cpp:119:42:119:43 | \\n | RegExpConstant,RegExpEscape |
+| regexp.cpp:119:44:119:44 | c | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:120:41:120:41 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:120:41:120:44 | a\\nc | RegExpSequence |
+| regexp.cpp:120:42:120:43 | \\n | RegExpConstant,RegExpEscape |
+| regexp.cpp:120:44:120:44 | c | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:121:25:121:25 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:121:25:121:28 | a\\nc | RegExpSequence |
+| regexp.cpp:121:26:121:27 | \\n | RegExpConstant,RegExpEscape |
+| regexp.cpp:121:28:121:28 | c | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:122:29:122:29 | a | RegExpConstant,RegExpNormalChar |
+| regexp.cpp:122:29:122:32 | a\\nc | RegExpSequence |
+| regexp.cpp:122:30:122:31 | \\n | RegExpConstant,RegExpEscape |
+| regexp.cpp:122:32:122:32 | c | RegExpConstant,RegExpNormalChar |
+regExpNormalCharValue
+| regexp.cpp:18:19:18:21 | abc | abc |
+| regexp.cpp:21:20:21:20 | a | a |
+| regexp.cpp:21:22:21:22 | b | b |
+| regexp.cpp:21:24:21:24 | c | c |
+| regexp.cpp:21:26:21:26 | d | d |
+| regexp.cpp:22:20:22:20 | a | a |
+| regexp.cpp:23:20:23:20 | a | a |
+| regexp.cpp:24:20:24:20 | a | a |
+| regexp.cpp:27:19:27:21 | foo | foo |
+| regexp.cpp:27:23:27:25 | bar | bar |
+| regexp.cpp:30:20:30:20 | a | a |
+| regexp.cpp:30:21:30:21 | b | b |
+| regexp.cpp:30:22:30:22 | c | c |
+| regexp.cpp:31:20:31:20 | a | a |
+| regexp.cpp:31:22:31:22 | f | f |
+| regexp.cpp:31:23:31:23 | A | A |
+| regexp.cpp:31:25:31:25 | F | F |
+| regexp.cpp:31:26:31:26 | 0 | 0 |
+| regexp.cpp:31:28:31:28 | 9 | 9 |
+| regexp.cpp:31:29:31:29 | _ | _ |
+| regexp.cpp:32:20:32:21 | \\w | w |
+| regexp.cpp:33:19:33:20 | \\[ | [ |
+| regexp.cpp:33:21:33:22 | \\] | ] |
+| regexp.cpp:33:24:33:24 | 1 | 1 |
+| regexp.cpp:33:25:33:25 | 2 | 2 |
+| regexp.cpp:33:26:33:26 | 3 | 3 |
+| regexp.cpp:34:21:34:21 | A | A |
+| regexp.cpp:34:23:34:23 | Z | Z |
+| regexp.cpp:35:20:35:20 | ] | ] |
+| regexp.cpp:36:21:36:21 | ] | ] |
+| regexp.cpp:37:21:37:21 | - | - |
+| regexp.cpp:38:20:38:20 | \| | \| |
+| regexp.cpp:39:21:39:22 | \\b | b |
+| regexp.cpp:42:23:42:23 | [ | [ |
+| regexp.cpp:42:24:42:24 | a | a |
+| regexp.cpp:42:26:42:26 | f | f |
+| regexp.cpp:42:28:42:31 | A-F] | A-F] |
+| regexp.cpp:46:21:46:22 | \\w | w |
+| regexp.cpp:46:24:46:25 | \\W | W |
+| regexp.cpp:47:21:47:22 | \\s | s |
+| regexp.cpp:47:23:47:24 | \\S | S |
+| regexp.cpp:48:21:48:22 | \\d | d |
+| regexp.cpp:48:23:48:24 | \\D | D |
+| regexp.cpp:49:21:49:22 | \\n | \n |
+| regexp.cpp:49:23:49:24 | \\r | \r |
+| regexp.cpp:49:25:49:26 | \\t | \t |
+| regexp.cpp:52:22:52:23 | !a | !a |
+| regexp.cpp:55:21:55:23 | foo | foo |
+| regexp.cpp:55:26:55:28 | bar | bar |
+| regexp.cpp:56:20:56:21 | fo | fo |
+| regexp.cpp:56:23:56:23 | o | o |
+| regexp.cpp:56:25:56:25 | b | b |
+| regexp.cpp:56:27:56:28 | ar | ar |
+| regexp.cpp:57:21:57:21 | a | a |
+| regexp.cpp:57:23:57:23 | b | b |
+| regexp.cpp:57:25:57:26 | cd | cd |
+| regexp.cpp:57:28:57:28 | e | e |
+| regexp.cpp:58:23:58:23 | : | : |
+| regexp.cpp:58:26:58:27 | \\w | w |
+| regexp.cpp:61:22:61:22 | a | a |
+| regexp.cpp:61:25:61:25 | b | b |
+| regexp.cpp:67:22:67:22 | a | a |
+| regexp.cpp:67:24:67:24 | f | f |
+| regexp.cpp:76:23:76:23 | A | A |
+| regexp.cpp:76:25:76:25 | F | F |
+| regexp.cpp:76:35:76:35 | a | a |
+| regexp.cpp:76:37:76:37 | f | f |
+| regexp.cpp:80:28:80:28 | A | A |
+| regexp.cpp:80:30:80:30 | F | F |
+| regexp.cpp:80:36:80:36 | a | a |
+| regexp.cpp:80:38:80:38 | f | f |
+| regexp.cpp:84:29:84:29 | A | A |
+| regexp.cpp:84:31:84:31 | F | F |
+| regexp.cpp:84:37:84:37 | a | a |
+| regexp.cpp:84:39:84:39 | f | f |
+| regexp.cpp:90:19:90:24 | \\u0061 | a |
+| regexp.cpp:93:19:93:22 | \\x61 | a |
+| regexp.cpp:96:21:96:23 | \\cA | \u0001 |
+| regexp.cpp:97:22:97:24 | \\cz | \u001a |
+| regexp.cpp:100:20:100:21 | \\0 | \u0000 |
+| regexp.cpp:101:21:101:22 | \\0 | \u0000 |
+| regexp.cpp:104:21:104:21 | a | a |
+| regexp.cpp:105:21:105:21 | b | b |
+| regexp.cpp:106:21:106:21 | c | c |
+| regexp.cpp:107:21:107:21 | d | d |
+| regexp.cpp:108:18:108:19 | \\f | \u000c |
+| regexp.cpp:108:20:108:21 | \\v | \u000b |
+| regexp.cpp:111:25:111:25 | a | a |
+| regexp.cpp:111:26:111:27 | \\n | \n |
+| regexp.cpp:111:28:111:28 | b | b |
+| regexp.cpp:112:37:112:37 | a | a |
+| regexp.cpp:112:38:112:39 | \\n | \n |
+| regexp.cpp:112:40:112:40 | c | c |
+| regexp.cpp:113:39:113:39 | a | a |
+| regexp.cpp:113:40:113:41 | \\n | \n |
+| regexp.cpp:113:42:113:42 | c | c |
+| regexp.cpp:114:38:114:38 | a | a |
+| regexp.cpp:114:39:114:40 | \\n | \n |
+| regexp.cpp:114:41:114:41 | c | c |
+| regexp.cpp:115:38:115:38 | a | a |
+| regexp.cpp:115:39:115:40 | \\n | \n |
+| regexp.cpp:115:41:115:41 | c | c |
+| regexp.cpp:116:23:116:23 | a | a |
+| regexp.cpp:116:24:116:25 | \\n | \n |
+| regexp.cpp:116:26:116:26 | c | c |
+| regexp.cpp:117:40:117:40 | a | a |
+| regexp.cpp:117:41:117:42 | \\n | \n |
+| regexp.cpp:117:43:117:43 | c | c |
+| regexp.cpp:118:42:118:42 | a | a |
+| regexp.cpp:118:43:118:44 | \\n | \n |
+| regexp.cpp:118:45:118:45 | c | c |
+| regexp.cpp:119:41:119:41 | a | a |
+| regexp.cpp:119:42:119:43 | \\n | \n |
+| regexp.cpp:119:44:119:44 | c | c |
+| regexp.cpp:120:41:120:41 | a | a |
+| regexp.cpp:120:42:120:43 | \\n | \n |
+| regexp.cpp:120:44:120:44 | c | c |
+| regexp.cpp:121:25:121:25 | a | a |
+| regexp.cpp:121:26:121:27 | \\n | \n |
+| regexp.cpp:121:28:121:28 | c | c |
+| regexp.cpp:122:29:122:29 | a | a |
+| regexp.cpp:122:30:122:31 | \\n | \n |
+| regexp.cpp:122:32:122:32 | c | c |
diff --git a/cpp/ql/test/library-tests/regex/regexp.ql b/cpp/ql/test/library-tests/regex/regexp.ql
new file mode 100644
index 000000000000..b8eb41e12dbb
--- /dev/null
+++ b/cpp/ql/test/library-tests/regex/regexp.ql
@@ -0,0 +1,15 @@
+import semmle.code.cpp.regex.internal.ParseRegExp
+import semmle.code.cpp.regex.RegexTreeView
+
+// Stop gap for missing flow configs
+class RegExpTest extends RegExp {
+  RegExpTest() { any() }
+}
+
+query predicate groupNumber(RegExpGroup g, int number) { number = g.getNumber() }
+
+query predicate term(RegExpTerm term, string c) { c = term.getPrimaryQlClasses() }
+
+query predicate regExpNormalCharValue(RegExpNormalChar term, string value) {
+  value = term.getValue()
+}