codeql/cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test.cpp

class String
{
public:
	String(const char *_s);
	void set(const char *_s);
};

void create(const String &filename);
bool rename(const String &from, const String &to);
void remove(const String &filename);

void test1()
{
	String file1 = "a.txt";
	String file2 = "b.txt";

	create(file1);
	if (!rename(file1, file2))
	{
		remove(file1); // DUBIOUS (bad but perhaps not exploitable)
	}
}


void test2()
{
	String file1 = "a.txt";
	String file2 = "b.txt";

	create(file1);
	if (!rename(file1, file2))
	{
		file1.set("d.txt");
		remove(file1); // GOOD
	}
}


void test3()
{
	String file1 = "a.txt";
	String file2 = "b.txt";
	file1.set("d.txt");

	create(file1);
	if (!rename(file1, file2))
	{
		remove(file1); // DUBIOUS (bad but perhaps not exploitable)
	}
}