[DIFF-INFORMED] C++: SSLResultConflation (has secondary config but passes test)

d10c · d10c · commit 21914030e874 · 2025-08-15T12:01:11.000+02:00
diff --git a/cpp/ql/src/Security/CWE/CWE-295/SSLResultConflation.ql b/cpp/ql/src/Security/CWE/CWE-295/SSLResultConflation.ql
@@ -31,6 +31,14 @@ module VerifyResultConfig implements DataFlow::ConfigSig {
   predicate isSink(DataFlow::Node sink) {
     exists(GuardCondition guard | guard.getAChild*() = sink.asExpr())
   }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSinkLocation(DataFlow::Node sink) {
+    exists(GuardCondition guard | result = guard.getLocation() |
+      guard.comparesEq(sink.asExpr(), _, 0, false, _)
+    )
+  }
 }
 
 module VerifyResult = DataFlow::Global<VerifyResultConfig>;

Original file line number	Diff line number	Diff line change
`@@ -31,6 +31,14 @@ module VerifyResultConfig implements DataFlow::ConfigSig {`
`31`	`31`	`predicate isSink(DataFlow::Node sink) {`
`32`	`32`	`exists(GuardCondition guard \| guard.getAChild*() = sink.asExpr())`
`33`	`33`	`}`
	`34`	`+`
	`35`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
	`36`	`+`
	`37`	`+ Location getASelectedSinkLocation(DataFlow::Node sink) {`
	`38`	`+ exists(GuardCondition guard \| result = guard.getLocation() \|`
	`39`	`+ guard.comparesEq(sink.asExpr(), _, 0, false, _)`
	`40`	`+ )`
	`41`	`+ }`
`34`	`42`	`}`
`35`	`43`
`36`	`44`	`module VerifyResult = DataFlow::Global<VerifyResultConfig>;`