mirror of
https://github.com/github/codeql.git
synced 2026-02-11 20:51:06 +01:00
C++: Simplify cpp/sql-injection barrier
SQL sanitizers will not likely also be sources, so using `isBarrierIn` here does not make a lot of sense. I ran with and without this change on MRVA and got identical results.
This commit is contained in:
@@ -45,9 +45,7 @@ module SqlTaintedConfig implements DataFlow::ConfigSig {
|
||||
|
||||
predicate isBarrier(DataFlow::Node node) {
|
||||
node.asExpr().getUnspecifiedType() instanceof IntegralType
|
||||
}
|
||||
|
||||
predicate isBarrierIn(DataFlow::Node node) {
|
||||
or
|
||||
exists(SqlBarrierFunction sql, int arg, FunctionInput input |
|
||||
node.asIndirectArgument() = sql.getACallToThisFunction().getArgument(arg) and
|
||||
input.isParameterDeref(arg) and
|
||||
|
||||
Reference in New Issue
Block a user