Merge pull request #14331 from asgerf/cpp/use-flow-state-inout-barriers

jketema · web-flow · commit 680aeea1ba53 · 2025-08-26T11:47:35.000+02:00
C++: use in/out barriers with flow state
diff --git a/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql
@@ -147,8 +147,8 @@ module ExecTaintConfig implements DataFlow::StateConfigSig {
 
   predicate isBarrier(DataFlow::Node node) { isBarrierImpl(node) }
 
-  predicate isBarrierOut(DataFlow::Node node) {
-    isSink(node, _) // Prevent duplicates along a call chain, since `shellCommand` will include wrappers
+  predicate isBarrierOut(DataFlow::Node node, FlowState state) {
+    isSink(node, state) // Prevent duplicates along a call chain, since `shellCommand` will include wrappers
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }

Original file line number	Diff line number	Diff line change
`@@ -147,8 +147,8 @@ module ExecTaintConfig implements DataFlow::StateConfigSig {`
`147`	`147`
`148`	`148`	`predicate isBarrier(DataFlow::Node node) { isBarrierImpl(node) }`
`149`	`149`
`150`		`- predicate isBarrierOut(DataFlow::Node node) {`
`151`		- isSink(node, _) // Prevent duplicates along a call chain, since `shellCommand` will include wrappers
	`150`	`+ predicate isBarrierOut(DataFlow::Node node, FlowState state) {`
	`151`	+ isSink(node, state) // Prevent duplicates along a call chain, since `shellCommand` will include wrappers
`152`	`152`	`}`
`153`	`153`
`154`	`154`	`predicate observeDiffInformedIncrementalMode() { any() }`