mirror of
https://github.com/github/codeql.git
synced 2025-12-19 10:23:15 +01:00
11 lines
364 B
Plaintext
11 lines
364 B
Plaintext
import cpp
|
|
import semmle.code.cpp.dataflow.TaintTracking
|
|
|
|
from FunctionCall call, DataFlow::Node source, DataFlow::Node sink
|
|
where
|
|
call.getTarget().getName() = "snprintf" and
|
|
call.getArgument(2).getValue().regexpMatch("(?s).*%s.*") and
|
|
TaintTracking::localTaint(source, sink) and
|
|
source.asExpr() = call and
|
|
sink.asExpr() = call.getArgument(1)
|
|
select call |