CPP: Do the logic at the target, rather than the access, as there are likely fewer.

cpp/ql/src/semmle/code/cpp/security/SensitiveExprs.qll

@@ -15,16 +15,24 @@ private predicate suspicious(string s) {
   )
 }
 
-abstract class SensitiveExpr extends Expr { }
+class SensitiveVariable extends Variable {
-
+  SensitiveVariable()
-class SensitiveVarAccess extends SensitiveExpr {
+  {
-  SensitiveVarAccess() {
+    suspicious(getName().toLowerCase())
-    suspicious(this.(VariableAccess).getTarget().getName().toLowerCase())
   }
 }
 
-class SensitiveCall extends SensitiveExpr {
+class SensitiveFunction extends Function {
-  SensitiveCall() {
+  SensitiveFunction()
-    suspicious(this.(FunctionCall).getTarget().getName().toLowerCase())
+  {
+    suspicious(getName().toLowerCase())
+  }
+}
+
+class SensitiveExpr extends Expr {
+  SensitiveExpr()
+  {
+  	this.(VariableAccess).getTarget() instanceof SensitiveVariable or
+  	this.(FunctionCall).getTarget() instanceof SensitiveFunction
   }
 }