mirror of
https://github.com/github/codeql.git
synced 2025-12-21 11:16:30 +01:00
Merge pull request #11197 from jketema/simplify-taint-test
C++: Simplify dataflow taint test query
This commit is contained in:
@@ -95,16 +95,7 @@ module IRTest {
|
|||||||
override predicate isSink(DataFlow::Node sink) {
|
override predicate isSink(DataFlow::Node sink) {
|
||||||
exists(FunctionCall call |
|
exists(FunctionCall call |
|
||||||
call.getTarget().getName() = "sink" and
|
call.getTarget().getName() = "sink" and
|
||||||
sink.asConvertedExpr() = call.getAnArgument()
|
sink.asExpr() = call.getAnArgument()
|
||||||
or
|
|
||||||
call.getTarget().getName() = "sink" and
|
|
||||||
sink.asExpr() = call.getAnArgument() and
|
|
||||||
sink.asConvertedExpr() instanceof ReferenceDereferenceExpr
|
|
||||||
)
|
|
||||||
or
|
|
||||||
exists(ReadSideEffectInstruction read |
|
|
||||||
read.getSideEffectOperand() = sink.asOperand() and
|
|
||||||
read.getPrimaryInstruction().(CallInstruction).getStaticCallTarget().hasName("sink")
|
|
||||||
)
|
)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user