hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Cleaner solution.

Browse Source
This commit is contained in:
Geoffrey White
2021-01-06 18:22:31 +00:00
parent 81205f37c5
commit b5bcbd303e
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
View File

@@ -28,7 +28,9 @@ class Configuration extends TaintTrackingConfiguration {
exists(SQLLikeFunction runSql | runSql.outermostWrapperFunctionCall(tainted, _))
}
override predicate isAdditionalBarrier(Expr e) { e.getUnspecifiedType() instanceof IntegralType }
override predicate isBarrier(Expr e) {
super.isBarrier(e) or e.getUnspecifiedType() instanceof IntegralType
}
}
from

8
cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
View File

@@ -545,8 +545,8 @@ module TaintedWithPath {
/** Override this to specify which elements are sinks in this configuration. */
abstract predicate isSink(Element e);
/** Override this to specify additional barriers in this configuration. */
predicate isAdditionalBarrier(Expr node) { none() }
/** Override this to specify which expressions are barriers in this configuration. */
predicate isBarrier(Expr e) { nodeIsBarrier(getNodeForExpr(e)) }
/**
* Override this predicate to `any()` to allow taint to flow through global
@@ -582,10 +582,8 @@ module TaintedWithPath {
}
override predicate isBarrier(DataFlow::Node node) {
nodeIsBarrier(node)
or
exists(TaintTrackingConfiguration cfg, Expr e |
cfg.isAdditionalBarrier(e) and node = getNodeForExpr(e)
cfg.isBarrier(e) and node = getNodeForExpr(e)
)
}