C++: Fix barrier in cpp/cgi-xss

jketema · jketema · commit 61676277e819 · 2023-10-13T14:05:47.000+02:00
diff --git a/cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql b/cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql
@@ -35,7 +35,9 @@ module Config implements DataFlow::ConfigSig {
   }
 
   predicate isBarrier(DataFlow::Node node) {
-    node.asExpr().getUnspecifiedType() instanceof IntegralType
+    isSink(node) and node.asExpr().getUnspecifiedType() instanceof ArithmeticType
+    or
+    node.asInstruction().(StoreInstruction).getResultType() instanceof ArithmeticType
   }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -35,7 +35,9 @@ module Config implements DataFlow::ConfigSig {`
`35`	`35`	`}`
`36`	`36`
`37`	`37`	`predicate isBarrier(DataFlow::Node node) {`
`38`		`- node.asExpr().getUnspecifiedType() instanceof IntegralType`
	`38`	`+ isSink(node) and node.asExpr().getUnspecifiedType() instanceof ArithmeticType`
	`39`	`+ or`
	`40`	`+ node.asInstruction().(StoreInstruction).getResultType() instanceof ArithmeticType`
`39`	`41`	`}`
`40`	`42`	`}`
`41`	`43`