hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: No need to exclude ExprNodes as sources now that #14903 is merged.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2023-11-24 16:58:30 +00:00
parent e89d8e2967
commit 73138f1913
3 changed files with 3 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.ql
View File

@@ -27,10 +27,7 @@ predicate isProcessOperationExplanation(DataFlow::Node arg, string processOperat
)
}
predicate isSource(FlowSource source, string sourceType) {
not source instanceof DataFlow::ExprNode and
sourceType = source.getSourceType()
}
predicate isSource(FlowSource source, string sourceType) { sourceType = source.getSourceType() }
module Config implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { isSource(node, _) }

5
cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.ql
View File

@@ -21,10 +21,7 @@ import semmle.code.cpp.ir.dataflow.TaintTracking
import semmle.code.cpp.ir.IR
import Flow::PathGraph
predicate isSource(FlowSource source, string sourceType) {
not source instanceof DataFlow::ExprNode and
sourceType = source.getSourceType()
}
predicate isSource(FlowSource source, string sourceType) { sourceType = source.getSourceType() }
module Config implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node node) { isSource(node, _) }

4
cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.ql
View File

@@ -62,9 +62,7 @@ predicate hardCodedAddressInCondition(Expr subexpression, Expr condition) {
condition = any(IfStmt ifStmt).getCondition()
}
predicate isSource(FS::FlowSource source, string sourceType) {
source.getSourceType() = sourceType and not source instanceof DataFlow::ExprNode
}
predicate isSource(FS::FlowSource source, string sourceType) { source.getSourceType() = sourceType }
predicate isSink(DataFlow::Node sink, Expr condition) {
hardCodedAddressInCondition([sink.asExpr(), sink.asIndirectExpr()], condition)