mirror of
https://github.com/github/codeql.git
synced 2026-07-23 04:02:07 +02:00
cc95e25e56
The two "Dead code" alerts (100379, 100380) point at the isSource and isSink predicates in `private module RegexPatternFlowConfig implements DataFlow::ConfigSig` in cpp/ql/lib/semmle/code/cpp/regex/RegexFlowConfigs.qll. Rationale (Case C): The predicates are genuine and correctly wired - `RegexPatternFlowConfig` is consumed by `TaintTracking::Global<RegexPatternFlowConfig>` on the very next line, which drives the `usedAsRegex` / `regexMatchedAgainst` public predicates. The DeadCode query cannot see through signature-parameterized modules and therefore flags every implementation-side `isSource`/`isSink` inside a private ConfigSig module (the same false positive is present on many existing configs across the codebase). Removing the leftover `private` qualifier on the config module resolves both alerts by making the module publicly reachable; the taint-tracking alias below it remains private, so no additional flow surface is exposed to consumers of this library.