Summary: sql injection: sink identification

SqlInjection.ql

@@ -30,10 +30,10 @@ class SqliFlowConfig extends TaintTracking::Configuration {
 // where conf.hasFlowPath(source, sink)
 // select sink, source, sink, "Possible SQL injection"
 
-
+// Sink identification
-// Source identification
+// rc = sqlite3_exec(db, query, NULL, 0, &zErrMsg);
-// count = read(STDIN_FILENO, buf, BUFSIZE);
+from FunctionCall exec, DataFlow::Node sink
-from FunctionCall read, DataFlow::Node source
+where
-where read.getTarget().getName() = "read"
+    exec.getTarget().getName() = "sqlite3_exec" and
-and read.getArgument(1) = source.asExpr()
+    exec.getArgument(1) = sink.asExpr()
-select read, source
+select exec, sink